Not sure if the Shield would spot any malicious botnets e.g. Mirai eminating to/from your IoT devices. I'd be curious to know also.
Probably the only way to be 'safe' with IoT is to segment your network so that the IoT devices can only reach the Internet. Most of these IoT devices require access to the internet to be operable or get updates. Either way, they dont necessarily need to access your lan, hence the segmentation. I've not found any good articles or how-to's on this topic, but I recently picked up a Ubiquiti Edge Router X as a first step to create a segmented network. Not gotten around to configuring it yet though :)
I heard Cujo ws partiularly problematic. First relying on ARP Spoofing and now (I believe ) using DNS. Besides, as mentioned they are subsciption services.
I've been playing with the Sophos UTM v9 on a J1900 based small pc recently. It's really good, but I'll need to take some time to configure it properly as it's anything but plug and play. Could be worth it though, it includes IPS amongst other things. Steep learning curve but could be worth it. I was acheiving my full download speed of 200mpbs no problem. Not currently in production but hope to put it in place soon. Alas, my Shield will be redundant but for now it's still going strong!
You can set it to check for updates whenever you like, daily, hourly, every 15 mins. If there are updates (antivirus, ips etc) it will pull them down and install. It definitely takes some configuration like I said, but it looks to be worth the effort and is free for 50 ip clients and 5 av endpoints.