I completely understand how IoT devices were used in the massive DDoS attacks because they are easily manipulated due to lack of firewalls, default passwords, etc.

What I don't understand is although easily hacked, most IoT devices are connected to secured private wifi networks. 

Here's the question: So is it assumed that these thousands of IoT devices' networks were hacked first, then the device itself was hacked? 

The devices are designed to be accessible from outside the home. To offer this service to their owners, they make themselves accessible through the homeowner's router/firewall. The way they do this is by sending a UPnP packet to the owner's router that tells the router to open a port that connects back to them. They then listen for connections that arrive directly from the internet.

In other words, the devices first hacked their owner's routers by design, which exposed their own vulnerabilities.  (This has nothing to do with secured, private, or open WiFi, other than many IoT devices connect via WiFi; UPnP exposes the exact same vulnerabilities on wired devices connected by Ethernet cables, too.)

To protect yourself, disable UPnP on your router.
