Maybe IoT manufacturers or even the consumers owning the things should be liable for damages if their products participate in a DDOS. "Underwriters" labs proves you built your product to some standard, and that presumably makes you insurable because you have a first line of defense against a lawsuit.