Other than that, these are really good.
I'd add something to address the problem of manufacturers going bust and then all their devices becoming paperweights. Perhaps:
6. it should be possible for the user to install their own firmware / updates. Optionally at the cost of losing guarantee and access to future manufacturer provided updates.
Some IoT devices could be handled the same way, but there are plenty of reasonable IoT applications where a password written on the device is impractical or a security risk.
Telemetry has huge implications and it can be literally anything. Photos captured by a webcam can be “telemetry”, manf can always say we were verifying our image sensor calibration.
I understand that VPNs are hard for average users, but centralised, potentially insecure server infrastructures, generally situated in China, pose a significant security concern.
I'd argue that even in that case it should still "function" without public internet connection, in the sense that everything but the egress transmission should be operable without public internet connection; e.g initial setup, later configuration changes, status, diagnostics, maintenance... Many devices use the "it's a transmission device by design" part as an excuse for "let's blanket require connection even for things that don't require it".
Instead of mandatory updates, there are lower hanging fruits you can win, and will have just as much, if not more positive security impact.
1. No default password, one must be set at initial configuration
2. Devices must function without public internet connection (unless it is one of the device's primary function to transmit out)
3. Devices must function without centralized host
4. Explicit disclosure of all "phone home" destination hosts, and ability to change or disable this
5. Explicit disclosure what information is transmitted out, and ability to disable this
I think the above five can be implemented relatively easily, requires no continued maintenance from the manufacturers, and improves the CIA triad of IoTs.