The differences between hardware exploitation and software exploitation are quite significant, with the most important being that to find vulnerabilities and exploits in hardware, you will need to have the physical device with you. This means that unless you have possession of two or more devices, it is pretty complicated to pen test an IoT device's hardware effectively.
Another factor that increases the complexity of working with hardware security is the amount of resources publicly available around hardware security. For instance, in the case of a software that you are assessing, the chances are that you might be able to find the existing vulnerabilities in one of the components that the software is using or a common vulnerability, which is found in the type of software that you are working with. It does not mean that hardware exploitation is tougher, it simply means that if you are getting started, you might find hardware exploitation...