And they could sue the manufacturer, for selling them a device not fit for use? Exactly how much would each party sue the other for? The damage only takes place in aggregate, when hundreds of thousands of devices become part of a botnet.

Or, how about instead of drowning in lawsuit chains over pennies, we establish some basic rules about how commercial devices connected to the internet are allowed to behave.

That's how this problem is solved by every other industry that manufactures devices that are dangerous when used correctly. Software isn't a special snowflake.

The proposal was mostly tongue-in-cheek. That said, I'm not sure the problem is solved in other industries - there's been plenty of unsafe electrical devices being sold to western markets, for example. It's just hard to police this stuff.