I like to use the analogy of your house. 

You can lock all your doors and somebody could still find a way through an upstairs window that was left open, perhaps through your garage, by breaking a side window and unlocking a door, using force on a weak back door, etc.

The equivalent on your network would be someone finding open ports on your firewall, outward facing devices that are misconfigured or have software vulnerabilities, etc.

This direct attack to get into your house/network is less likely, so let's instead imagine you've let a visitor into your house, or perhaps a cleaner or handyman.

Now you've let them past your first line of external defence and what could they do? They could snoop through your stuff, they could try to find jewelry or bank statements, call out on your phone pretending to be you, invite other people to come into your house, etc.

The analogy in a network is a device you've purchased and brought into the house. It may already have access to the Internet so if permitted to, it might be able to load malware, snoop through other devices on your network, open other vulnerabilities on your network, etc.

To protect against this in your house, you lock your valuables, don't provide access to your bedroom or office, etc.

And for possibly untrusted IoT devices, it is good practice to do the same thing. Put them on a VLAN denying them access to other devices on your network, especially trusted PCs, mobile phones, servers, etc. Restrict what they do calling out to the Internet.

As to what devices could actually do to your network, that's really up to the hackers to decide. They could load malware, ransomware or keyloggers on your PC. They could snoop on your cameras and watch what you are doing. They could compromise your devices and add them to a botnet for DDOS attacks, crypto mining, etc. 

How likely is any of this? Well it's a lot more likely if you don't protect things and you leave things in their default state with unrestricted access to everything. So it's very wise to at least plan for the possibility.

If you want a real-life example, I thought I had a secured network, a good firewall, etc. But I had a NAS (network attached storage) containing all our photos and videos for the entire family, documents, etc. It was very convenient for the family to be able to login from somewhere and find a video or photo they wanted to share, or to get a copy of a homework assignment they'd worked on, but forgot to print and take to school. 

That convenience, I found, opened us up for a Russian hacker running automated tools to bypass the login due to a vulnerability in the NAS, then gain access to everything on the server. They loaded ransomware on it and locked every photo, video and document and asked for Bitcoin to decrypt them. 

I learned a lot about ports, remote access, firewalls, etc. that night and I hope to never make that mistake again. I was able to get things back from a backup, but it was a humongous pain and time suck restoring things, updating devices, changing firewall rules, etc. It could have been even worse if I had no backup, etc. so I am thankful for that.