This is true, but honestly I have almost never seen an IoT device getting updated for security reasons - instead they seem to update things OTA to just add more

This is true, but honestly I have almost never seen an IoT device getting updated for security reasons - instead they seem to update things OTA to just add more crap to it. In any case, a CA lasts ~20-30 years. Hopefully the IoT device will be dead by then