You seem to be suggesting a law must say "the maker of any unsafe insecure product is subject to 50 years of jail or $4million". More realistically, legislator

You seem to be suggesting a law must say "the maker of any unsafe insecure product is subject to 50 years of jail or $4million". More realistically, legislators should be crafting incentives. Establish liability statutes. Carve out liability exceptions for companies that can show they used industry best practices, hired engineers that are members of professional/industry organizations, pay for ethics training, establish good faith effort of security development (unit tests, integration tests, traffic encryption, encryption at rest, well designed key exchange architecture, software/firmware update architecture for at least X years after sale, etc). Conversely, if a company does none of the above, it's easier for a consumer or an Attorney General to bring a case against the company, even if it's years too late to be useful. The problem with litigation (as well as "free-market" solutions) is that this generally doesn't happen fast enough. The security damage of IoT will be externalized extremely quickly. Being able to identify and sue a foreign company that is far up the supply chain from the end-product.