All that being said, I have no idea how much manpower or money it would take to do audits at that scale, or even what the scale of IoT Devices vs. Medical Devices is.

Still, many IoT companies that sell products don't even have protocols or a QMS at all, and need some kind of heat applied to them.

The companies that do well already just add to their costs (and prices) as they need to employ people to maintain these systems, and companies that do badly will also have to hire those people, and increase their prices, but they will be creating a paper shield around the products, rather than a genuine product improvement.

You might think these kinds of things are table stakes, and I would agree.

Agreed on the current state of the FDA filings - there's a lot of paperwork and process auditing - but guidance is lacking and I'd like to have more clarity rather than just "industry best-practices." That said - things are much better and it seems like the trajectory is improving.

Edit: Reasonable timeframe should probably be dependent on the size/scale/competency of the marketplace platform. In other words, Amazon should be held to a higher standard than a low traffic web store.

I don't see any particular entity benefiting from security labels - it's a problem of the "commons" where you generally need government intervention of some sort of.

IFF companies have financial liability, then the market can be expected to find a cost-effective solution.

Without any selection pressure though, there is no reason tho think the market will spend resources to solve this. Users empirically don’t understand security, don’t price it appropriately in advance, and aren’t able to evaluate the security qualities even if they do want to pay more for a “secure” product.