I thought you had a point but then I remembered how funny it is. If you are dealing with sensitive customer data you shouldn't get to skip security.

It is actually cheap and easy if we change the question: Should you be allowed to run a closed source proprietary platform with insufficient security? After all, if you open it up and let people do what they want it becomes their responsibility.

Bricking the device at a predetermined date isn't very elegant but it would work. Maybe the user should have the option to return it (working or not) and get some money back.