[harg]

I don't think customers not caring is a valid reason to not do this. Compromised IoT devices don't only cause harm to their owners, but also external networks and the internet as a whole.

A compromised doorbell, or lightbulb etc can be used as part of a botnet to perform DDoS attacks or other nasty activities.

An analogy is like saying we shouldn't work on reducing the pollution emmitted by motor vehicles because the users of these vehicles don't care about how much pollution they cause and would buy them regardless. It's the negative externalities that we need to consider.

[baby_wipe]

I haven't thought through the externality argument very much. If I do I will come back and respond. I'm sure there are people more thoughtful than me who have said something about it.

Something to keep in mind though, government regulation itself is an externality.