> Vizio, for example, settled a $17 million lawsuit last year for secretly tracking and selling the usage habits of sixteen million Vizio owners for around three years.
$1/user may be your fine, which can still allow you to turn a profit whilst doing absolutely everything the wrong way.
Why would they spend more development on security or privacy? The incentive isn't there. Your device being hijacked into a massive botnet swarm doesn't mean that you as a company get hurt. People still buy your toy at a huge markup, and the regulations in place won't even put a dent in your profits.
These aren't companies intending to go out and do things the right way, they're companies that churn.
The good players get left behind because they don't have a new shiny product every 3-6 months, and the bad players can quickly and seamlessly change their name and registration and just keep churning out horrible security-compromising hardware and software.
The consumers aren't cautious or knowledgeable enough, the regulations don't offer carrots or sticks that can make behaviour better. No part of the current state of things can encourage anything to change... So why would it?