Medical devices kill people when they break. Hopefully IoT devices don't, and the liability will be correspondingly lower.

If your company makes no attempt to patch vulnerabilities, and your devices become one more bot in the botnet, there should be some liability for this.