Even when they are protected, when did they receive the last update? There are probably so much more vulnerable IoT devices.
Encryping by the application would kill the use of a lot of sql features such as SUM.