This is the big problem, and regulation can not fix it. If companies are expected to pay programmers and testers and support staff to keep their devices up-to-d

This is the big problem, and regulation can not fix it. If companies are expected to pay programmers and testers and support staff to keep their devices up-to-date, that money needs to come from somewhere, and cloud "services" that don't provide any value but exist only for MRR and lock-in are only going to result in a bigger attack surface and a bricked device when the company folds or loses interest.