I have to admit, the idea of a run-of-the-mill security-hole-ridden IoT device being exposed to the bare internet over a wireless connection that's out of my control gives me the heebie-jeebies... and that's ignoring the possibilities for malicious use (e.g. using a low powered wireless connection for uncontrollable surveillance/data collection).
The operators would argue this is where their "managed service" offering kicks in and gives you value.
Most operators haven't figured out their business model for NB-IoT quite yet (at least in Europe) - they're still dabbling. Some seem likely to try pair it with enterprise "private APN" type solutions. Under such a setup, you can actually get quite an interesting system in place - the operator locks the SIM to a custom APN, and that APN only allows comms to a managed, operator-provided IoT backend.
Then the operator's enterprise services team turns that into dashboards and other things the customer can use and access. In a sense, they're using "extra slack capacity" on their FDD cellular networks (as an NB-IoT carrier is only 200 kHz wide and can sit inside or adjacent to a regular 4G or 5G carrier), and delivering higher margin managed enterprise services.
Some other comments point out the potential to use LoRa - indeed, although if you can use LoRa, you probably aren't the target market for NB-IoT. If you want to deploy 50 million smart meters, a nationwide existing network and managed service from the operator starts to get appealing, as does them handling security, isolating the devices onto a private APN, and helping you update devices in the field.
If you are using LoRa, you need to handle this and deploy the infrastructure. To date though, I've seen lots of "unmanaged" NB-IoT testing taking place, but not a whole lot of the "full service managed offering".
Otherwise I would agree entirely with your point about connecting modern IoT devices to the internet, but in this case I think it will end up for enterprise type deployments where they're restricting that for you.
