Well, sure its grey but it's a finite and definable quantity

Addressing known and reported vulnerabilities would be a start - many routers and phones have known vulnerabilities and can be pwned in minutes.

Then I would include degradation of service - example, I have samsung bluray box that came with YouTube functionality. Withing 1 year that didnt work any more because of changes to youtube. Withing a period of time they should be judged to maintain such software degradations.