As far as I can see, Shodan seems to be choosing the IP and ports randomly from a list. Is this really the best way to scan the entire internet for IoT devices?
In order to scan the entire Internet, you need to scan the entire Internet: every combination of IP address and port. Further, you need to do it in a way that hides what you're doing, so you don't get blocked.
A simple sequential scan is the obvious way to do it, but a sequential scan is trivial to spot. Instead, Shodan scans in an apparently-random pattern (a permutation of the complete list of address/port combinations), and does so from a wide range of source addresses. Doing this means it takes longer to say that a given address does (or does not) have an IoT device on it, but it also makes the scan look more like the random noise of the Internet.