Nest have done a really good job of poisoning the well of consumer IoT. If a well funded startup acquired by a tech giant isn't going to do this properly then what chance does anyone else have? Absolutely disgraceful.

Fundamentally the idea end point devices should be connected to the Internet is wrong, and this means the idea the manufacturer should run any associated cloud service or be responsible for "security updates" is also wrong.

The only long term solution to this is that "smart devices" not be given direct access to the Internet, where the security problems are, and live instead in their own strictly segregated networks controlled by something conceptually like Home Assistant but where it also acts as a broker between all local devices, with a whitelist only policy for networking access. Until that becomes the default mode for deploying these things the consumer IoT space will continue to fail to meet expectations.