Also while this attack did involve a botnet which used default credentials there will be attacks that infect via RCE or any other unauthenticated vector or simply don't require a botnet at all like say adding a multicast IP address to some wificamera or telemetry device that would cause it to send its traffic to a victim of your choice.
At the end you want to make sure your network and services are resilient to DDoS attacks, securing the endpoint source of choice everytime isn't that good of a strategy.
My point above is that there are very sane regulatory changes that we can implement immediately, as part of attacking this problem.
The problem with "IoT"(got I hate this term) is that it connects mass produced lowest barrier of entry devices with network stacks over pretty substantial bandwidth lines.
The difference between "residential" and "commercial" bandwidth is eroding it's no longer orders of magnitude greater even if you are pulling multiple 1gbit lines from your DC.
"IoT" are often not that purposely built they are going to share SoCs and likely firmware/software that will make 100,000's of units if not more vulnerable to compromise.
If you have say a 1M Apple HomeKit enabled light switches across Europe and the US which were built by some lowcost/OEM "insert_your_brand_name_here" manufacturer vulnerable to a single exploit you get the same problem.
And this problem will happen over and over and over again with different devices.
Nor would this regulation have to come from government. The details could be delegated to a UL-like industry group.