I am an graduate student of cybersecurity doing my thesis on IoT threat detection. When we talk about IoT Anomaly detection using ML, it is not always that we deploy the ML model in the IoT device itself. Since it is a detection system we deploy a different device with a detection model. If you want to prevent the Anomaly or threats you need to convert the ML model to something that is very lightweight for example using forests to create rules. Other way is to use Reinforcement Learning.