Be careful, when you mess with corporate America you're basically going head on with momma bear US government.

Assuming the aren't well programmed, it might be preferable to spoof them with junk data.

Is anyone MITM-ing and publishing the data these devices are sending? It would be nice to reverse engineer and document their APIs. Somebody needs to be watching the watchers.

I’m worried by how much I like this idea

Interesting. Rather than restricting what is sent could one just spam them with garbage so they can't distinguish what's real from what's fake?

Would it note be relatively trivial for the manufacturer to just filter incoming requests by whitelist of registered ids of their appliances?

Not really - either you send the ids unencrypted and they're trivial to falsify, or you send them securely, in which case it takes a lot more power to decrypt each request for filtering than it does for the attacker to send each new request.

DDoS protection is surprisingly challenging - usually it's relegated to a CDN provider, but that would be more difficult when the actual consumers are the same people most likely to be hosting botnets.