Simplicity-first is a good point. By choosing more complex, extendable system, the manufacturer can deliver extra functionality. But on the other hand, every

Simplicity-first is a good point. By choosing more complex, extendable system, the manufacturer can deliver extra functionality. But on the other hand, every bit of additional complexity requires maintenance (both security and as standards evolve). IoT companies rarely seem to care about the latter, which ultimately only impacts the customer (unless there's a recurring service model of revenue). Something like the digital hazardous waste idea should be mandatory in the IoT space. Either: (a) you provide timely security patches for all shipped code and a way to apply them to your product, OR (b) you freely offer such tools, keys, and source as are necessary for users to self-patch. Don't want to be responsible? Don't include unnecessary functionality.