Sorry, that's bullshit. Automatic updates are one of the worst ideas about IoT devices, because the updates almost always remove functionality. Manufacturers have been known to remove key functionality, or just straight out brick recently sold devices when they have liability concerns or their business plan changes and they don't want people using the old devices anymore.

  - http://www.theverge.com/2016/4/4/11362928/google-nest-revolv-shutdown-smart-home-products

  - https://nest.com/support/article/Nest-Protect-Safety

I agree with you, and my point was that the list I replied to is not well put-together since we must remove the fifth requirement, that the manufacturer should not administer the device. Yes, they should. (Chromecast being an example.) so we're saying the same thing - it's just in conflict with the suggestion that manufacturers shouldn't administer devices remotely.

This doesn't solve the security issue though, it just moves it to the self update mechanism.

Lack of updates create a security issue. In fact, I'd argue that update mechanisms are the most critical security issue of our time!

By neglecting to update devices you increase risk by ensuring vulnerabilities won't get fixed. You also might not get notified in the event of product recalls (if you never registered your purchase).

I understand your argument though: By solving one security issue we're creating another: Trusting the vendor. To that I have this to say...

If you don't trust the vendor why did you buy their product in the first place!?

Updates cannot help against zero day vulnerability. A better solution would be not to allow anyone to connect to a device.

Lack of choices? Nearly all PCs and phones come with crapware I don't trust.