After Mirai botnet disaster, government decided to step-in to IoT security landscape. I am not sure how far they can go to force consumer electronic manufacture

After Mirai botnet disaster, government decided to step-in to IoT security landscape. I am not sure how far they can go to force consumer electronic manufacturers to add security to their products. Some CE manufacturers do not control the bulk of the software in their products. They just take kernel/libraries/binaries provided by SoC vendor and glue them together. SoC vendors are even more careless about security and they often provide out-dated and unpatched software. Even if SoC vendors or CE manufacturers start patching the vulnerabilities, it is very difficult to implement a secure firmware upgrade mechanism. A glitch in automated firmware upgrades can be very risky. Perhaps FCC could start addressing these issues as part of certification requirements. However there are many challenges. How will FCC enforce SecureBoot and secure firmware upgrades and longterm product support? What will be the penalties. How will they deal with unbranded (or foreign) brands.