Netgear Customers Urged to Turn Routers Off

Not that other companies are immune to this, but it sure does feel like a bullet dodged having moved from Netgear to Ubiquiti hardware in my house.

At what point are consumer router manufacturers (as well as other vendors that are pumping out vulnerable IoT devices, for example) deemed responsible for damages or negligence?

I understand it's difficult to regulate something along these lines but there should be some threshold for required maintenance after launch, minimum security advisories (like no global default username/password), defaulting to no internet admin, etc.

The vast majority of people buy the thing, plug it in, and never touch it again- vendors should be responsible for making these things safe out of the box.