So what you're saying is that you'd make a new version of BACnet to make it suitable? A new standard? Were I Apple, I'd refuse to let my devices connect to any insecure devices - it'd lead me open to many horrible 'I got a virus and it unlocked my door' online stories which would be horrible for business and stop the process in its tracks - and so the new standard would not be backwards compatible. So, if we had a new standard, there'd be loads of BACnet devices that did not support my stuff (consumer confusion), huge trouble negotiating the standard with all the current stakeholders, and a lot of cruft that I'd have to implement that I don't really want to implement (lift controls etc).
What I meant by the IPv6 comment was that consumer networks are switching to IPv6 at a high rate, and IPv6 only networks might become a reality in 10-15 years (with an external ISP 6to4). It's ok for businesses to stay on IPv4, but most in the consumer space use their ISP provided routers. In this case, we'd likely see large incompatibilities with most of the BACnet devices - we'd end up with this weird split standard.
In this case, we have this interesting situation where we have many BACnet branded devices, but only a few are relevant for the average consumer.
The reason that home users have ethernet and IP is because of the hourglass model. The reason that most services just work is that they talk TCP/UDP - anything below that they can ignore - so if we use a new hardware layer, if we use FDDI etc we can still use TCP because everything talks in IP. BACnet kinda breaks that - you mentioned ZigBee adding BACnet support - ZigBee has supported IP for ages - had BACnet followed the hourglass model (as literally every other internet service I have ever seen has done) then support for BACnet would have been immediate and unnecessary to trumpet.
Re overkill - again, it's about the hourglass principle. http://named-data.net/wp-content/uploads/hourglass.png - the idea is that we all achieve massive interoperability by using IP. BACnet doesn't quite fit into that, mostly because it replaces IP for (as I understand it) no particularly good reason.
You want standards when you have a mature market and you want to prevent lockin. Standards in an emerging market can lead to stagnation and reduced innovation, as each change must be agreed by the stakeholders (who might have opposing visions) - like what happened with OAuth 2.0. This is why (say) new programming languages typically have a few years of backwards incompatibilities before they get standardised.