Mostly reasonable, but shortsighted it seems to me. How do they expect to enforce these requirements on the manufacture of the IoT crap sold by the vendor “Bes

Mostly reasonable, but shortsighted it seems to me. How do they expect to enforce these requirements on the manufacture of the IoT crap sold by the vendor “Best Security Happiness Store” on AliBaba, and the unnamed (or outright counterfeit named) Chinese manufacturer they bought it from? And conversely, they could obviously easily apply this to the UK based Raspberry Pi foundation, but who’s responsible for enforcing the “no way to reset to a known factory password” for the pi:raspberry login from a stock Rasbian install? (Or do we just hand wave that away and say “that’s not a consumer device, even though we’ve shipped over 30 million of them!”?)