The owner. If you can't patch it, put it off the grid. If owners become liable they will care whether companies will be able to provide fixes in the future. A

The owner. If you can't patch it, put it off the grid. If owners become liable they will care whether companies will be able to provide fixes in the future. A somewhat radical solution: if an IoT device has vulnerabilities you go free in bricking it (=making the device non-functional, nothing else). This will put strong incentives on secure devices.