All that and they make no mention of updates. A minimally viable security level for any product needs to be updated after sale and over the air by the manufactu

All that and they make no mention of updates. A minimally viable security level for any product needs to be updated after sale and over the air by the manufacturer. IoT is terrible at security and that is critical. Legislation is useless without ongoing security.