&quot;Exploits are always changing&quot; is not really a meaningful objection, because it applies to <i>every</i> way that one might try to ensure security short of only deploying software and systems that have been mathematically proven to be secure.<p>The vast majority of exploits against IoT devices do not involve new exploits. They involve ridiculously ancient exploits, like finding plaintext passwords embedded in the firmware, or adding something like &quot;&amp;admin=1&quot; to the end of a URL.<p>If we could get to the point where breaking an IoT device requires something like finding a hole in, say, the TLS protocol (or in a widespread TLS library), rather than just <i>looking</i> because the damn thing doesn&#x27;t use encryption at all, we&#x27;d be vastly better off than we are now.<p>This is what I meant when I said, &quot;I&#x27;d be happy for now just having some rules to try to make it so IoT device breaches are mostly due to bugs in the implementation of a good design, rather than due to the producers not having a clue about security&quot;.<p>Right now far too many devices are vulnerable even if they are 100% bug free.