It would help if there were reference designs and testsuites for common embedded tasks like remote updates, configuration storage, input validation, etc.

I don't do much embedded work these days, but I remember a lot of shoddy, ersatz designs based on random OSS components. I remember a small mfg of hardware devices used widely in payment processing tell me they were secure because "they used SSL" despite not taking care of physical or system security in a coherent, effective way.

Honestly, companies need to have some liability or other incentives to even care about security a lot of the time.