This is probably the only way to enforce the correct incentive for manufacturers. Build them right or they will fail.

IoT being so hyped right now is specially troublesome since all they will care is time to market, and when the market is filled with insecure devices what else will there be to done?