The pressure was probably from the ISP side. This is easy to make for the ISP, just one extra line in the request for tender. For IoT devices it is harder to p

The pressure was probably from the ISP side. This is easy to make for the ISP, just one extra line in the request for tender. For IoT devices it is harder to push through, there are no real incentives to spend on security except the potential for bad marketing once systems are compromised. In my company we usually have unique device and server generated public/private keys so compromising one device will not make the whole fleet vulnerable. This is just one of the methods. In most cases security is really hard to sell to the project managers at early stage of R&D unless they have had prior unpleasant experience or market mandated stringent requirements themselves. After all, making systems more secure is usually going to make projects longer and more costly on the paper. "Security is not part of the MVP and we will worry about it later" is way too common reaction.