This may be a joke, but it's notable that the EU has the Cyber Resilience Act, which makes producing devices with this kind of lack of security illegal. Broadly speaking it takes effect from December 2027.
I work in embedded security. CRA and RED are game changers. We can argue this is years late but at least EU is giving security requirements teeth. Very expensive teeth.
I haven't seen US enterprise data teams sit up and do something as quickly as they did when GDPR rolled out very often. Regardless of other issues, the toothy part seems to work.
DORA the explora act. You pay the ransom and the fine.