Yes, but NIST recommendations are non binding. It is the ability to create legally binding standards that attracts rent seekers and prevents technical expertise from being the primary factor in decision making.

As far as they go, yes.

But what about something like firmware updates? What should be the frequency of update? How long am I required to support a device? Which update networking modalities am I required to support?

These aren't small decisions. They can make a product viable--or not. Having this in the hands of something with the proven competence of the TSA (har har) is far from desirable.

You make a good point. We seem to be in the "Wild West" phase of device software, where the companies making the product have created guidelines based on competitive design, development and maintenance/update standards rather than standards created by regulatory bodies.

On one hand this can be abused to create artificial end-of-life scenarios by some hardware companies, but allows for a wide variety of choice in the companies providing alternatives. It also provides the end-user with less restrictions. Caveat emptor.

On the other hand, a regulatory agency could reign in companies trying to artificially shorten the lifespan of a piece of hardware, but at the same time make the standard of support a huge barrier to entry that restricts choice to only the largest companies. There might be less rampant IoT exploits, but there'd also likely be less personal freedom to do what you want on your devices.

Given how other industries like telecom and cable have trended, we'll probably get the worst of both worlds. There'll be expensive regulations that serve as barriers to entry for smaller companies, but the regulations won't do much to restrict corporate malfeasance.