New 0-Day Attacks Linked to China's 'Volt Typhoon'

Vendors just find it too difficult to certify against attacks at the “script kiddie” level, so they lobbied the government to lower the standards so even the lowest rated systems, ones not even audited for security, are allowed for general usage in critical systems.

The large commercial vendors, such as Apple, Microsoft, or Amazon, have spent billions of dollars and literal decades trying to improve their security and have uniformly failed to certify that they can deploy any system that can protect against small commercial teams unlike actual high security vendors who can produce systems secure against even state actors.

But you can, as an organization, choose to follow one and be "Secure by default", with exceptions e.g. "Open a port other than 443 to the Internet" being understood and risk managed.

It will slow down developers, for sure. But everything's a tradeoff.

Not really. In > 99.99% of software projects, the risk of an error leading to people dying is lower than it is for a surgeon or a air traffic controller.

Additionally, software is an extremely broad tool, like mathematics, that can be applied to nearly any domain. Consequently, slowing down devs via regulation as you suggest will also slow both technological progress and economic growth. In a few circumstances, the risk may be enough to justify that cost, but it there’s high bar to clear.

(a low blow I know)