How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do yo

How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do you quantify liabilty due to a security vulnerability in some sub-component or somewhere in the software stack? How do you assign liability if thousands of different IoT devices are compromised and DDoSing the White House page? How do you deal with bankrupt or foreign suppliers? Or people using products that have been end-of-life-ed? Or how do you keep regulation up to date with current security standards? This is an incredibly hard problem.