Note we've had worms and such for decades now and most of them don't deliberately break things. It's generally far more profitable to exploit the resources than simply destroy them. Brickerbot almost certainly wouldn't be if we weren't all getting affected.
Best case scenario: users claim warranty and replace their devices something better
Worst case scenario: users need to buy new gear, they probably won't buy from that same manufacturer because last one died for no apparent reason. Really worst case scenario: users buy again the same cr*p and dies again, until they realize that brand is worthless and buy something a bit better. Doesn't seem so bad, if the alternative is having their machines taking down businesses and users...
FTFY
Im only having a few possibilities come to mind that are life-threatening. Most are just annoying or financial drain. If we add painful, maybe make an epileptic's screen on SmartTV blink fast like the attack on the web site. Turn off people's alarm clock enough they get fired and loose health insurance before major operation. Im really having to stretch it here.
John J. Citizen should be thankful if the person who finds it only wants to deactivate it rather than use it to poison him / shoot him / run him over. No matter who finds it though, it's tough luck for that person; they're the owner of that item in name only, if they don't secure it.
Society has decided in some cases (in domains well-understood by legislators, unlike IoT) that the person doesn't deserve to keep that item if they don't secure it. Example: "Improper storage of a firearm" or the like, is literally a crime in many jurisdictions and can result in losing your gun license. Creating a burden on or a danger to society through your neglect has in that case been affirmed to be unacceptable. The law will catch up with this too, I hope.
How about in arsenic? The Internet of Things is mostly insecure trash that will only be fixed by throwing it away. The manufacturers know this, and simply don't care.
Very few people that use the internet were unaffected by shitty IoT security. And that seems like it was just the start of it's capabilities. Something needs to be done to destroy these cyber weapons. If your stupid light bulb is recruited into a cyber weapon, then it should be prevented from harming others.
Right now, we're beginning to treat DDoSes in that "infectious agent"/"your responsibility if you don't act to protect yourself" way. So many people do them, so often and so easily, that "shutting down the botters" one-by-one will never make DDoSes go away. So we have to just figure out how to deal with them. (Which will, coincidentally, make DDoSes actually go away, if everyone ends up immune to them such that it's no longer useful to do one.)
But, annoyingly, we still handle bots programmed to scan for and exploit software vulnerabilities (worms, ransomware, what-have-you) as only intentional malicious action on the part of their original author, to be solved by catching the author. (Not that you can't catch the author—but that won't stop a worm, and especially won't stop someone else from just slightly-modifying and then re-releasing the worm.) We haven't bothered nearly at all with the "how do we make software vulnerabilities, as a class, less exploitable" part of the equation.
Personally, I'm hoping that this decade sees "A-Life" computer worms, that self-modify using (machine-readable?) 0days they discover by spidering the web from their infected hosts. Computers would be being attacked with novel exploits, even with no new malware authors to do the attacking! Then we'd really have to treat vulnerabilities as a fact of life to secure around, rather than something we can stop by just stopping people from bothering to exploit them.
Yes, this a rotten situation, and I sympathize with the motivation. No, I don't think we should blithely disregard the fact that the worm is likely causing genuine harm and that it was in fact created to cause harm.
Right now we have script-kiddy teenagers; Real Soon Now there won't be much reason to expect your average 5-year-old with a Youtube account, won't be able to slap together something like a ransomware worm from readily-available components, that will spread itself a billionfold. And, amongst 7 billion people and growing, there's going to be a lot of kids thinking that that sounds like a fun time.
The only thing to really stop this from being the world we live in, is making worms irrelevant.
(And what we do in the short term, about this case? Honestly, I haven't bothered to think about it. Too "identity politics.")