Malfunctioning hardware that physically damages their customers' property, on the other hand, is something the significance of which they will understand immediately. A few lawsuits here and there, a few percents off of their stock price -- these are the language they speak, and we must learn to speak it too if we want to encourage them to do something.
Question is, what did we used to have that drove research efforts in the more beneficial ways we used to see?
I don’t know the answer to your question, but decoupling progress from profits would be a good idea.
An international body dedicated to knowledge and research for their own sake, funded by everyone, maybe?
And even within the security community there is a shift in the last couple of years with sexy names and bespoke websites for specific vulnerabilities. Apparently there is a need to get security out of the technical realm and into the public eye for reasons that transcend FUD.
It's just that when you have a computer connected to two networks, it takes every little for it to act as a router.
Sure, if someone can look at the sticker on the bottom of my router and see the serial number and learn the default password that way without having to attack it iteratively, thats still a problem. But a random default password would have to be communicated to the end user somewhere, too... and as with most things, by the time an attacker has physical device access you've already lost.
A lot of routers come with random, long passwords printed on them as the default. No reason this shouldn't be standard.
But i don't think this looks one of them, they seem have a very easy and reproducible attack entry point open for everyone and the consequences are very tangible.