As the Internet of Things (IoT) in critical information infrastructure rapidly scales up, its widespread deployment in sectors such as energy, transportation, and industry is introducing unprecedented security challenges. While driving intelligent transformation across industries, the IoT technology also brings systemic security risks that impact national security, economic operations, and social stability. This study examines security issues in traditional IoT architectures—cloud, pipe, edge, and device—from both general and scenario-specific risk perspectives, and explores emerging threats in trends such as embodied intelligence and four other key application areas. Based on current conditions and development trends, the study clarifies the security implications and core risks of IoT in critical infrastructure. Aligned with its architectural features and practical needs, a "universal guarantee + customized enhancement" protection approach is proposed, advocating a new-generation security system that offers full coverage, dynamic collaboration, and adaptive intelligence. Systematic efforts in strategy, regulation, technology, talent, and international cooperation are recommended to achieve sustainable and evolving security governance.