I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over.
It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.
IMO a better metaphor would be to car manufacturers being held responsible for undue environmental degradation, something that does happen to a degree already. (Hello Volkswagen!) The manufacturer should be held responsible for damages to common infrastructure or resources caused by design flaws or deliberately negligent design.
In the case of IoT security, it's probably more realistic that we see manufacturers held liable. But in my book owner liability would be fine exactly because it keeps ownership with the owner.
If some DDOS victim can show your camera was pinging them, then he can sue you for 1 cent per ping or something. It's only $200 in total, no big deal. But it will make you ask for more security on your next IoT purchase.
But to use an Internet of Shit device safely, well, I could do it, but I'd have to uncrate a firewall, freshen its software and get it to play nicely with my AT&T U-verse modem/firewall, freshen my knowledge of packet filtering, and then....
This is not my forte, and obviously impossible for the vast majority of people. Instead, to borrow a phrase from RMS/FSF, these defective by design devices need policing, perhaps at a pretty severe level (e.g. requiring stable responsible entities, which could be 3rd parties (should be, actually, since hardware companies are particularly notorious for bad software and security practices), requiring updating capabilities, ISP policing (https://news.ycombinator.com/item?id=12772979), etc.), we need to generally improve the state of the art, etc. etc. etc.
To bring it back to the gun analogy, some basic human factors allowing the rigorous application of 4 rules (https://en.wikipedia.org/wiki/Jeff_Cooper#Firearms_safety) are all that's needed to keep them from causing unintentional harm (and teaching these isn't hard), just sitting in my holster this morning when I went shopping, mine wasn't going to do anything bad as long as I retained it from a bad actor trying to snatch it (and first he'd have to realize I was carrying it).
Whereas all it takes is plugging in an IoS device into the net, following the instructions provided for the consumer, for bad actors to compromise them and cause increasing chaos.
We're in for some interesting times; this furthers my determination to make sure I can be productive with my computer(s) without the net being available, and my recent and very much related to all this decision to not go "paperless" with all my utility etc. accounts.