California IoT Cybersecurity Bill Signed into Law

There is no way around it, IoT will never be feasible until companies start to take updates seriously. Slapping a fully upgradable, WiFi-enabled Linux-based firmware on appliances whose usable life spans several years if not decades (haven't changed my fridge in more than 15 years) can lead to disastrous consequences if the manufacturer stops providing security updates (something they totally do not care about, as they've shown with their android devices).

I don't see how this could be solved without a fully open platform like the PC, where a third-party company (like MS on the PC) can ship a whole OS on every single machine without having to develop a custom firmware image because thanks to standards.

Having glanced over the bill, I see too many phrases and words that make the bill optional. Also, it uses the word reasonable, as it pertains to security. That is entirely subjective and not defined in the law.

Are there any lawyers on HN today that can correct my interpretation that this law has no teeth and no actionable items?