I don't see this as a failure of the "security industry" (I put that in quotes as it's very hard to say who is and is not part of that group) The simple fact i

I don't see this as a failure of the "security industry" (I put that in quotes as it's very hard to say who is and is not part of that group) The simple fact is that there are very limited economic incentives for a company in the IoT space to spend money on security, and as a result they don't. It's not easy for an ordinary consumer to differentiate between a company who just says "security is our top priority" and one who puts meaningful effort behind that (e.g. there is a strong market for lemons here). Also there's no effective regulation which could substitute for that information. In other markets (property, consumer goods, food and drink) we have safety regulations as it was recognised that consumers can't effectively differentiate. In IoT and other areas of IT this doesn't exist, so there's nothing to stop insecure devices being sold. As to the "security industry" well there have been enough practitioners warning about this, to limited effect. Realistically there's a limited amount that can be done without some form of top-down intervention.