I think I'd start by removing, at the hardware level, the ability of the IoT devices to do general computing and networking. They accept authenticated external control instructions, they execute the instructions, they physically cannot do more. Most likely there would be no updates at all. There would also be a physical off switch.

My idea is that, if you limit the IoT device - say, a thermostat or a smart bulb - to only have the exact capabilities it is supposed to have, then the damage from any external hack is limited to messing with the user's house. And, if the user has the ability to turn it off, the damage of the hack is limited to "the device doesn't do anything anymore".

I figure this is much better than the possibility that breaking the security enables the IoT device to spy on the user's network traffic, or their house, or be part of a botnet, or a bounce point for hacking attempts.

EDIT: I recognize there are good real-world reasons why IoT companies don't do it this way. If we actually valued security, then there would be an incentive for someone to build up the systems to facilitate this kind of limited-attack-value design.