How would the device receive security updates? Or is the hope/expectation that the device would have no security vulnerabilities? (That seems hopelessly naive.)
I'm not just talking about IoT devices. I want this for my washing machine, my electric toothbrush, my vacuum cleaner...everything.
1. If you insert a formatted thumb drive that contains a directory with some magic, standardized name (e.g., "DEVICE_INFO"), the device creates a directory under that named after the device, and in that directory writes out a PDF of its manual, install guide, warranty info, and/or whatever other documentation comes with the device. It also writes a text file containing model number, serial number, manufacture date, version information, and stuff like that.
2. If you insert a formatted thumb drive that contains a directory with another magic, standardized name (e.g., "FIRMWARE_UPDATES"), which contains a sub-directory names after the device, the device looks in there for a firmware update file, and if it finds one that is applicable it applies it.
Keep in mind that having a remote update process is a security risk in and of itself. So some people might want to opt out from such updates and firewall the device off entirely, if its functionality does not require a live internet connection this should be possible.
What about security bugs in a device's offline functionality? For example, imagine a keypad door lock. It can be configured online to add and remove unlock codes and to set schedules for automatic locking/unlocking, and then goes offline for normal operation.
Suppose someone discovers that certain invalid input sequences will unlock it regardless of what codes are set. I'd say that's a security bug that requires a security update, even though what it is fixing is functionality that does not require or use an internet connection.
https://www.google.com/search?q=smart+door+lock+vulnerabilit...