how many years until iot manufacturers get sued for producing insecure devices?
Thus, if you want to go the legal/penalty route, you need to sue the end users. The entity that owns the house/office that installed the unpatched CCTV camera is effectively responsible for the behavior of that camera. If they then want to shift the responsibility to the manufacturer, that's their choice (and effort).
What it will do is make users consider a bit more carefully when choosing devices and manufacturers, and it will make manufacturers have to consider (and promote) their security and patching practices to maintain marketshare.
There are already safety standards and according mandatory certification processes in place that (should) prevent electric appliances from burning down your house (CE) or from bringing down airplanes (FCC).
What is (urgently) needed is a similar approach to mandatory IT security certification for IoT devices. This is also advocated by Bruce Schneier [0]:
Security engineers are working on technologies that can mitigate much of this risk, but many solutions won't be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public [...]
[0] https://www.schneier.com/blog/archives/2016/07/real-world_se...
The same way they do for everything else. Ask experts. Demand third-party reviews. Require warranties for security flaws.
It will be far worse at the beginning. But once you really threaten the bottom line for free, security will come.
I sadly see no other good way to have security in software.
If a precedent is set (after all cars get recalled all time for flaws) then we would endup with a more secure internet.
This is not a user issue. Manufacturers need to issue recalls and be made liable for shipping insecure by default products.