"This device uses [x,y,z] techniques for avoiding [interference/hacking]" is provable. List of required techniques should be known in advance (like ["no default password", "no raw tcp password sending", ...]). I have seen such requirements when delivering devices for some big companies which care about security of devices reselled by them, I think it was even some publicly defined standard, but can't find it now. Such things exist already, but are just not enforced like interference requirements.

>It is a prove a negative vs prove a positive

No, it isn't

>"This device has no security holes" is often not provable even if they try to secure it.

That's not how security compliance is determined

Just as is done with HIPAA compliance, NIST compliance, etc. there would be a framework of security controls that need to be adhered to