If you don't like the "regulations to prevent bad stuff" approach, then use the "we'll let you do whatever you want, but if you screw up you're going to pay dearly to fix it" approach.

Then companies can balance the cost of adding a secure enclave and a Grsec kernel (just an example) to their smart coffee maker against having to recall all of their infected products from the market when a botnet takes over them.

Besides that stick, I would throw a couple of carrots in there, too, like the companies being able to brag that their products are A+ security rated, etc, in their promotional materials and on their packages.