I would argue this is tangential to another massive problem: corporate IT teams are largely overwhelmed with the number of security patches required to keep their entire network updated (my company is in this space).
Device manufacturers not patching their devices is one issue (zero day), but it's not likely the largest issue. I would say that devices that have patches available, but unapplied (Unpatched Vulnerabilities) are at least 10x bigger problem. I don't think your observation and the UV problem are unlinked -- most electronics manufacturers don't have a streamlined way of developing a patch, notifying the device owners/controllers, and pushing it quickly+easily to their devices.
The {CVE database, OVAL, OSQuery} are useful, but it's very difficult for network owners to identify devices and know whether they are patched, let alone act on that and test+apply patches organization-wide.
Getting companies to issue updates and fix security problems in these devices seems like one of the most important issues we're dealing with security wise.