I think these goals are necessary, but not sufficient, solutions to the IoT security nightmare. In particular, they miss the biggest problem that leads to these

I think these goals are necessary, but not sufficient, solutions to the IoT security nightmare. In particular, they miss the biggest problem that leads to these problems -- manufacturers simply do not care. Many (most?) companies making IoT systems not only don't care about making sure their OTA update systems comply with these constraints, they probably don't even care about implementing any update system at all. Then, even in cases where (rudimentary) update systems exist, such as consumer-grade routers for example, the time frame for when updates are actually available is laughably small -- perhaps 12-18 months after the device's launch? Approaches which focus on the technical challenges of OTA updates (a key area of my doctoral thesis, and one I care deeply about!) miss the mark, in my opinion, because the primary reasons why we've ended up in this mess in the first place is due to business challenges, not technical ones. Until consumers actually care about their devices being updated, or legislation arrives to force businesses to care even when consumers don't, improving technical solutions to the problem is putting the cart before the horse.