I didn't say it was easy or a solution to the problem. I was adding an additional point of context to a discussion in order to clarify the parent comment, which was insinuating impossibility of said action.

It's not easy, but it's not impossible. I could envision a software based solution that approaches simplicity in installation.

What I'm not arguing, is that someone should be held liable for their devices being used in a botnet.

I believe the manufacturers and retailers have the liability. But I am definitely not a lawyer.