This doesn't seem to cover novel attacks, just applying basic security patches for a stated lifetime. If that lifetime is "six months" then you have to state th

This doesn't seem to cover novel attacks, just applying basic security patches for a stated lifetime. If that lifetime is "six months" then you have to state that. If that means we can't buy insecure IoT lightbulbs with no tls, no authentication and no sha checking for under $10, I guess we'll just have to live with it.