Already, I see a few questions which, while they seem to be about the security aspects of IoT, are really just plain security questions, applicable also to non-IoT situations & devices.
Should the security tag mention https://security.stackexchange.com/? It is quite likely that many posters are not aware of it, or did not think of it because, "hey, I have an IoT device".
Possibly even some extra code, to generate a pop-up when submitting a security tagged question, to explain the difference between the sites and ask if the question should be migrated there? Or is that too much?