Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the certifications should check that:
* The device always uses some form of encrypted communications if at all possible based on what it's communicating with
* If the device implements some form of remote control, that remote control includes both sufficiently secure authentication and authorisation mechanisms to ensure that at least it will take some effort to break into
* The device does not leak personal data to unauthorised or unauthenticated requesters, and provides a clear list of what data will be willingly communicated to whom (software should do that too...)
And so on...
The certification process could/should be implemented by high-reputation security companies like Kasperski or Matasano...
Until/unless some barrier to entry is erected, I think it's inevitable that everything that can be connected will be, and that this will mostly be insecure. In the meantime, I guess the solution is to only buy potentially connected devices from premium technology companies (e.g. Apple, Microsoft, Google, Tesla, Nest, etc) - but then, of course, those companies don't sell everything (e.g. no microwaves, car washes, etc) so that would limit the range of things you can safely purchase, for now...
On that note, given how corrupt and broken the US system is, perhaps this needs to start in Europe, where there is already a general mindset of consumer and personal data protection...