A researcher who was able to control his so-called 'smart' car three years after he sold it raises concerns about secondhand IoT devices