Depends on how you define web. IOT should be done in low level languages. but yeah I agree that a REST server is better of in something like GO, C#, or JAVA.
IOT is generally less of a target. I'm more talking about http endpoints to be consumed by browsers anywhere in the world. That makes the whole world your adversary.
