The major issue is we know the minimal least effort steps involved to keep these things working aren't hard. Release a firmware update that updates the device

The major issue is we know the minimal least effort steps involved to keep these things working aren't hard. Release a firmware update that updates the device to only point to ips/domains in the private range as it's new control/update/whatever server and update any security certs to a new releasable one. Then open source the server software if not still in use, or roll back the firmware the x number of years to the point were the requirements to maintain the device started diverging and release that version of the updated old firmware/old server source. There's no ongoing cost to the company and people can continue to use their devices if they wish to put in the effort to maintain it. I mean I'm not up in arms about this case, but it's such a common story about how device/software is no longer usable because finance wants to turn off a server that it should be SOP in every sunset plan. I'd go so far as saying it should be regulated as the minimum.