Since most people don't give a shit about privacy anyway, I'd argue that IoT makers should simply remove all burdensome security from their devices. It's hard adding security to a device. Consumers want useful features, they don't want added costs for developing security. Besides, most efforts to secure a device can be exploited anyway with a little effort.