> and have no tangible security impact

I would not object to a tariff on shitty IoT devices, with the level determined by things like if the default password is "admin".