Ideally the user should have to specifically consent to inbound communication on an instance-by-instance basis, even from the manufacturer. There's many cases where forced updates are triggered that change/limit functionality unexpectedly. There's numerous anecdotes of people's devices being required to update to be used while they have some pressing need to use it.
I dont want 30 semi/unmaintained apps to manage each manufacturers security settings.
I have a Winix air purifier that has a sensor and filter lifetime suite that I cannot communicate with because it refuses to connect to my "IoT" SSID that has no access to the outside internet (no, you stupid piece of crap, my WiFi is working fine, now just start sending data damnit).
It also makes it so you can't operate devices in offline networks. (this is already a thing due to apple's cert changes)
1. software stack – big fat "firmware" should not exist. Entire stack should be upgradable safely, securely and frequently during its official supported lifetime and should be open-sourced for owner's own upgrades past end of life. For this, the hardware stack needs some amount of standards compliance.
2. Vendor should clearly declare/advertise the period for which they will support the device. During this period the device vulnerabilities should make them liable. After this period, they should mandatorily open-source the device drivers and unlock the boot loaders to enable free software alternatives to work on them. For certain class of devices, there should be mandatory minimum period of support.
3. Networking capabilities should be legally standardized and verified/certified before being released to market and checked for continued compliance and fined if out of compliance.
3.1 Use of latest mainstream TLS with valid certificates should be mandated for all communication.
3.2 If there is outbound communication from the device, it should make it clear to which domains it will communicate with so that it is easy to allow only that through firewall and keep everything else locked.
3.3 IoT should not accept inbound communication without authentication.
3.4 Follow best practices w.r.t rollback resistant cryptographically verified secure and brick-safe software upgrades.