> ... for the manufacturer to simply publish the API ...
That is more work than not publishing the API. How much more work then? I'd pick stats from The Mythical Man Month where they claimed that doing something for external consumption is nine times the effort than internal only. Admittedly it does predate AWS, containers etc, but then again those aren't that useful for iot.