Maybe we should leave the task of authentication, encryption and whatever phoning home these devices need to do to some kind of industry standard relaying protocol that lives on a router. You would then only need updating the router to keep any WAN activity safe for the IoT devices. Updates can also be delivered safely trough this mechanism, which lazy manufacturers would definitely still forget to do (but may be useful for keeping local network access safe , which would not rely on this mechanism).

That is, if router manufacturers could also keep their crap safe...

If you don't trust an off the shelf router for this, you could also use a computer setup as a router with such relaying software. It would be as simple as running a dhcp server or something.

Routers could also default to denying any authentication from WAN, with the user changing this policy on a per device basis or just allow eveything.