Cellular IoT doesn't really have the problem seen with Mirai & co DDoS attacks. A cellular device is attached to a cellular network first, and for many application are not even on the Internet.
In 3GPP cellular IoT (2G/GPRS, 3G/UMTS to HSPA, 4G/LTE) it is very common for devices to be on what's called a private APN. It's a private IP network, and the cellular operator provides a VPN access to this private network to let the managing company access the devices from their application servers. Only the application servers can access the devices, which are not on the Internet. In practice this removes the risk of remote attacks on the devices (if you either hacked the telco or service operators and can get to the devices, you already could get to more interesting stuff like aggregated data). This has been available since GPRS and will also apply to 5G --- no difference at this level.
Of course the flip side of this model is that the end customer must go through the device associated service provider to get to the device. It may not be acceptable to all, but when it is using a private APN is really a very effective way to kill remote attacks on cellular IoT devices.
Even for devices not using a private APN but having Internet access, the operator is still in between and could do ad-hoc filtering if called for. Another factor is that tier 1 telco operator tend to require support for FOTA (Firmware update Over The Air), so cellular IoT devices can be remotely upgraded.
With all this cellular IoT is in a much better situation for security than LAN-based IoT. It's also more expansive.