You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad. If they don't get mad, they probably like the reduction in competition.

If they were liable there is no profit margin. These products will never exist.

> If the vendor simply used open source libraries, then it needs to review and take responsibility for the code,

I can imagine a lot of licensing hassle here. Worked for Technicolor in Edegem, not on routers / STBs but know the challenges. There are tons of libraries used by virtually every device in the field that no company will touch b/c of licensing hell.

It would also incentivize vendors to fund critical FLOSS with direct development support on safety-critical functionality.