> what are the secure-by-design type of recommendations for this new paradigm in which my devices are now default-reachable from the outside world? And specifi

> what are the secure-by-design type of recommendations for this new paradigm in which my devices are now default-reachable from the outside world? And specifically how does that paradigm not only inform the iot device design, but how does a typical consumer insure against insecure iot devices? Do they now need to know how to find the iot manufacturer's address space and whitelist it in their router's firewall rules (and all that for the marginal gain of server-initiated connections)?