What is buffered connectivity?
Or, as compute power, storage and hardware get less expensive, running two cryptoledgers for inbound and outbound communications would make it easier to sanitize every bit that enters a network.
I like squid and other products, but I think dropping TCP/IP from the LAN or tranfering all packets in amber (bitledger) would correct a lot of the present shortcomings with security, privacy and unfixable manufacturer defects.
Needing physical access to compromise a system sounds like a much better way to play whack-a-mole.
If the hardware cannot protect itself, moving the defense to the next layer out sounds plausible to me.