So tossing out an idea:

What if all manufacturers had to classify their product into internet connected i.e. smart or not. We mandate that manufacturer has to support updates for minimum 5 years or firmware source goes public. Have them put firmware source in escrow as well as have a way to update it.

If a manufacturer wants to reduce their liability then they have to release something to make it semi publicly supportable. With AI agents these days patching the firmware might one day be trivial.

Put some penalities with teeth behind this and maybe manufacturers will think twice before making everything smart.