There really are too few business models available to build sustainable IoT solutions, apart from subscriptions (and only Security companies seem to have figured this out), pyramid schemes (letting your new users pay for maintaining the whole solution), or plain old planned obsolescence (with forced upgrades, like with Smartphones).

I'm not sure what models would work, apart from regulators stepping in and mandating x years of updates, like with the European regulations. Which basically comes down to #3.