Multiple reasons like not enough v4 IPs, devices being able to sleep most of the time to conserve power, security cameras and IoT devices getting hacked and faling prey to by botnet operators etc.

> not enough v4 IPs

No one is giving their IoT devices public IPv4 addresses. They would be behind a NAT. RFC 1918 provides 17,891,322 usable IP addresses for each private network. If we want to be a little more adventurous, RFC 6598 provides an additional 4,194,302 usable addresses and 240.0.0.0/4 is another 268,435,454 usable addresses "reserved for future use" since 1989, but still sitting unused so we can use them as internal addresses inside a NAT anyway (for example, AWS uses this range internally).