It's "online marketplaces" like Amazon (or AliExpress) where you're actually purchasing from a random third party seller, and the marketplaces attempts to disclaim as much liability as possible that I'm more wary.
I actually don't know the specific laws or regulations on this. It's very possible that it's illegal for Home Depot to sell a non-UL or other nationally recognized laboratory mark. It's probably that it's illegal for third-party sellers on other sites to do it as well, but my faith in Amazon and other "online marketplaces" for policing their third party sellers on this kind of stuff is...not high.
I'm just trying to be a lot more careful about the stuff that goes into real circuitry, because I'm more used to playing with low-voltage DC stuff where I'm just not too fussed about it, so I feel OK ordering anything cheap that probably works.
---
Finally, I think it's actually a regulatory and consumer information _success_ that you feel safe buying something from Home Depot and wiring/plugging it into your house without thinking about the product safety risks. The reason for that is _those risks have largely been eliminated_. There was a time when you _did_ have to be super careful as a consumer of electrical products. Over the years, we've drastically improved the safety of these kinds of products to the point where we for the most part don't have to think about it anymore, because it's not a problem anymore. That's effective government regulation at work.
Manufacturers that believe the same thing as you can just opt to forego placing the FCC's mark on their packaging. We can just test the theory in the marketplace. If you and those manufacturer's suspicion is correct, then the mark will just fall by the wayside unused.
The only way manufacturers could be harmed by the requirements to obtain this mark is if consumers _do care_.
So, where's the harm in testing your theory against mine? It's very similar to the Energy Star program run by the EPA, which is a voluntary mark which is now on many appliances sold in the United States.
Second issue is a cybersecurity label from a trusted source is already something that can be issued, by, say, the ISO consortium. You don't need the FCC to do that.
Third issue is while the FCC is doing that, they're not doing something else.
Fourth issue is while they're not doing something that works, the consumer still faces the issues that this was supposed to solve!
It's impossible to say that consumers don't care about a specific certification before it exists based on their existing behavior. Consumers _do not have any ability_ to distinguish on this axis at the moment. So, we can't say: "based on their behavior they don't care". They very well might, and just don't have the information necessary to tell.