Security conference talks fall into two categories
* we designed a distributed entropy siphon to perform a black-box hypervisor side channel escape and chain-load a persistent rootkit into the CPU cache
* we looked behind the sofa and found an entire industry of products/services that have made no attempt at security at all and are therefore vulnerable to the most basic issues that we've been finding in everything for the past 30 years, and no-one else had bothered to look.
@richardstephens second category is very popular with radio stuff where it's just like "this is secure because nobody else could build the custom hardware to decode or transmit this signal", and the researchers are just like "we have software defined radio now!"