(This is assuming they aren't using pinned certs baked into their firmware, anyhow. I don't have good data on which manufacturers/devices are doing this, but somebody else might know.)
If you want to run those devices in production, put them in a separate network or VLAN where they can't see anything they don't need to see.
As it is, don't Chromecasts refuse to function if they can't reach 8.8.8.8? Add encrypted DNS to prevent inspection and transparency, and people are being asked to have potentially hostile devices in their network with no way to inspect them.
(And the PKI infrastructure is the best thing we have; I'd certainly like to see it replaced with something even better.)
So creating a system where I, as a consumer, have no way to inspect the communication my devices undertake removes my rights and safety in deference to companies that really just want to make it harder to block ads.
I take issue with this entire model. The fact that PKI has had piles of issues with bad actors who are supposedly supposed to be bastions of trust doesn't give any example this is a system we should trust, much less have browsers force people to utilize and scare people off avoiding.