Short answer: yes absolutely you can data spike/tar pit any device, drones included.
Longer answer: In 5e: when a Rigger is Jumped In to a drone, the drone's matrix icon ceases to be and only the Rigger's Persona icon can be targeted. This technicality was not continued into 6we.
In 6we, PANs work a little differently. If the Rigger has slaved the drone to his RCC/Commlink, then yes you have to first compromise the PAN before hacking the drone. If the drone is not being protected, then yes you can go after it directly.