I would just mandate that hardware not receiving security updates (this needs to be defined carefully to avoid people just version bumping) should be required t

I would just mandate that hardware not receiving security updates (this needs to be defined carefully to avoid people just version bumping) should be required to open source the firmware for said device and even allow commercial versions to be created from it by other vendors. I would think some serious updates to enhance the working and extend the life of IoT devices would come along if this was the case and it would create rather than destroy a lot of value for the public.