Maybe that figure would change if the firmware could indeed be updated.

It would change, but again -- it wouldn't be appreciable.

Security policy is needed that accounts for the behaviors of the vast majority of users.

Users update their phones, there's no reason they can't be educated to update their other devices

Most non-technical users that I know don't actively update their phones and push back when I tell them that they need to do so faster than the automatic process because of an actively exploited vulnerability.

They may have trusted family members, friends, or neighbors who they feel comfortable allowing the management of their internet connected devices.

No. As long as their iot device is still working consumers could care less about security updates.

What do you mean by "no"? Are you denying the existence of my grandparents who trust me to manage their devices?

This approach may function effectively with your close family members. However, it can sometimes fail when your cousins won't let you near their IoT devices because they view you as the hacker or tech enthusiast who might tamper with their gadgets.

So what? Just because there are some atypical people doesn't make it a "no".

I am saying that people like you are not enough to help the 99% of people who have an iot product.

Apart from Smart TVs, most people don't have an IoT device to begin with.

Smart speakers, printers, thermostats, light bulbs, security cameras, door bells, locks, smartwatches, TV sticks...

I don't count a watch as an IoT device. And most on the market are Apple devices.

Apart from printers and smart TVs, less than half of US households have any of those other devices.

https://www.statista.com/statistics/1124290/smart-home-devic...

Anecdotally, most people I know who own those devices are the more technically inclined. Especially the thermostats and light bulbs. Even the doorbell surveillance networks have low penetration.