“Many manufacturers oppose making any commitments about security updates, even voluntary ones. These manufacturers are heavily engaged at the FCC and represented by sophisticated regulatory lawyers.”
Commissioner Nathan Simington wanted a rule forcing IoT makers to ship security updates for a reasonable time. He is not the chairman and could not bring it to a vote. What survived is a voluntary label that discloses how long a device gets patches, and industry fights even that. Comments close September 25, and the lobbyists have already filed theirs.