In short – yes, they can.
Not only that, but they can act as a gateway to your entire home network. That way, cybercriminals can not only control your smart bulb, for instance, but they can gain access to all devices connected to the network. Thankfully, most modern antivirus software should be able to protect your smart home devices as well.