3rd party SDK requires TLS and it's not easy to bypass. Development contract doesn't allow long-term support where they can push updates if/when proper CA bundle changes.

Solution: ignore security in 1st party code outside 3rd party library that tries to prevent ignoring security.

As far as I know, most of this cheap crap is basically supply chain management companies that contract a factory to manufacturer and contract a software development/IoT/chip company to write software. Everything is waterfall-style locked in with no ongoing support or funding after the production run is done. The software company doesn't care insomuch as it "works" and working to the SCM company is "powers on and functions", not "is secure". As such, there's not much accountability. If the endeavour gets bad publicity, they just close up shop and spin up a new brand.