The average consumer also does not give a flying fuck about the security of these devices unless they find out their baby camera is connected to the internet and strangers are watching their kids sleep. (E.g. no consumer is going to care that their smart lightbulb participated in a DDoS)
It was always going to be external factors that lead manufacturers to start giving a damn about security. Whether this is litigation (more likely in the US) or regulation (more likely in Europe) is yet to be seen.
I doubt manufacturers in China will care at all, unless the Chinese government starts caring because it's causing them issues on their domestic internet.
I'm not saying the solution here is to have lawyers suing every manufacturer for an RCE, that's not sustainable. I also don't think that requiring all IoT devices to be UL Security Certified™ (I just made this up) is a great idea either.
Something which is secure when tested in 2017, might not be secure in 2018.
I think the real solution will be when consumers realize most of this IoT stuff is a gimmick for manufacturers to be able to sell you something that requires a paid subscription to function, when the old model, while admittedly not "smart" worked just fine.
If you buy an IoT device and there's no subscription, then the only way the manufacturer stays in business is by selling more devices. For a device that requires updates to stay secure, this is a recipe for a bad time.
IoT isn't for the average consumer, it's for companies to be able to sell more chips and services.
Look no further than smart meters if you want a prime example of how utilities have utterly wasted the benefits of having nearly real-time data on their customer's consumption. Meanwhile the meter and IoT chip manufacturers have been able to sell them X million units. Billions of dollars invested and they are still no closer to the "smart grid" than when they started.