I want to add that I am not sure yet what my position on this is. But I think your analogy is not correct - and please feel free to correct me if I am wrong!
Imagine the following scenario:
Manufacturer's sell weapons cabinets to people. Only weapons cabinets are not hidden in your home, instead they are put out on the street. And now comes the dangerous part: These weapon's cabinets do not lock. Because the manufacturer decided that locks are not necessary.
If someone comes along, should he just ignore this or should he make the weapons unusable?
Because that is what these devices will be used as: weapons.
I think a big problem here is that people are discussing points like manufacturers should be blamed / fined, or that the owners of the devices should be responsible etc, but no one is addressing what seems to be the real issue that most owners of these devices don't understand them enough to actually know these issues potentially exist.
In your analogy I would say its not that people are leaving these weapons cabinets on the street unlocked, but don't know that its possible to lock or hide them.
Another good example would be cars, if you went to the showroom and someone showed you a two cars, one with no locks on the door that was easy to start without the keys, and one that had proper security the choice would be easy and you could understand what you're seeing.
If you go to a shop and someone shows you two IOT devices that do the same thing, and look identical, you cant really see anything that helps you learn about the security features, and as an average person if you're told one has certain "tech speak" security words you don't understand are you really going to make the choice to spend more money to protect against something you don't fully understand, that you don't see any effect from?
Yes manufacturers should be made to release products that are secure and respond to security issues in a timely manner, but we also need to educate people that computers aren't some magical box beyond their understanding, blaming owners in these cases would I think make the issue worse.
If you consider that the majority of people who have the internet get their ISP to set up their router, and only have a basic understanding of what that device does, how can we expect people to understand what the potential issues of open ports or vulnerable firmware are? And then could these people even be educated to the level we would need for them to be responsible for securing their own devices?
Imagine the following scenario: Manufacturer's sell weapons cabinets to people. Only weapons cabinets are not hidden in your home, instead they are put out on the street. And now comes the dangerous part: These weapon's cabinets do not lock. Because the manufacturer decided that locks are not necessary. If someone comes along, should he just ignore this or should he make the weapons unusable? Because that is what these devices will be used as: weapons.