But how could you ever really be sure that the device couldn't take an update assuming it must be connected to a network in order to fulfill its function? Hardware is so complex these days it's not really feasible to prove negatives.
If you catch any of your own device doing that, you report it to a government agency and they'll check in their database if your finding is new, and if it is, they will immediately pay you $10k and announce it publicly.
And then afterwards, the government can fine the manufacturer $100k to recoup their costs.
Also, most of the updates that people hate have been pretty blatant. Like when your TV starts showing ads when it was ad-free before, it is pretty obvious that something changed.
Also, I expect enthusiast users and large companies to purchase similar devices as small telcos. Scorned network administrators are probably even better bounty hunters.
But yes, I was focusing mostly on the end-user aspect because if you want to create such a law, you need your citizens to like the idea.
It's not really practical or enforceable. If a world power wants to hide something nasty in silicon or software, a bug bounty program isn't going to cut it. Maybe if the government had a genius-savant who could stare at silicon dies and find malicious circuits.
Not just that, for about a decade now I've had a thought that you could just have a chip "self-destruct" when a signal goes out and bam a chip re-writes itself to be bricked.
If you bake this into some common chip (or just include it in a firmware update), or something used in say backbone level network hardware, or something in millions of cellphones you could send out the instruction in some previously routine traffic to and from the mothership and then a clock starts counting down. You build in long enough of a delay to ensure you get most devices to receive the signal, say a week or even a month, and you suddenly cripple millions of devices and create mild to moderate chaos which gives gives you a leg up for an invasion or has a massive impact on the markets, or cripples internet access for a large area for weeks or months until hardware can be replaced.
For example, kidnapping people who may or may not have information and torturing them.
If the bounty got high enough, it would pose a serious risk to low-level Huawei employees.
And do you think a bounty would help against a Stuxnet type attack? Stuxnet did almost nothing until it would up in a very specific type of device.