The security levels of most electronics products connected to the Internet, be it IoT or routers, can only be described as criminal negligence. There is no financial incentive for the manufacturers to invest into proper security, and they typically just add some junk to the firmware they get from the SoC vendor and ship.

I'm not sure I agree that making the vendors liable in case of vulnerabilities is the right way. It should probably suffice to require vendors to define a guaranteed product support period, where they are obliged to provide security patches, and then hold them liable if they fail that.