Comment by TadasPaplauskas

Forgetting to lock the house or batteries in detector running out is an accident. Not providing secure and up-to-date firmware for devices which are known to be an easy targets is a company policy, which comes out of incentives (the cost of security is huge compared to the cost of a breach to IoT manufacturers). While we cannot/should not legislate against accidents, we sure can and must legislate against harmful policies. Shifting blame from companies to hackers simply is not as productive as making companies responsible for the quality of their product.