What if there is a power cut?
Is my data at risk?
For most well designed commercial IoT devices you need not worry about sudden power loss. Let's take case on the Nest Thermostat.
The Nest Thermostat uses the Micron 2 Gb NAND flash memory. Given its NAND flash, the file system used must be YAFSS, as YAFFS has been designed specifically for use with NAND flash. YAFFS uses techniques such as journaling, error correction and verification techniques tuned to the way NAND typically fails. These techniques provide reasonable cover against corruptions due to power failures, crashes or unforeseen acts.
Should I buy a separate battery to power them to prevent the risk of corruption?
For a well designed commercial devices, No.
For your own hobby projects based on Raspberry Pis, Arduinos, Yes, unless you get a fault tolerant file system in place.
If there is no physical power button on your IoT device, then you can safely assume the device has been designed for sudden power loss, device manufacturer must have used fault tolerance file system.