> You can't enforce those same policies on most consumer software because people consume it the same way they do food.

The government can. GDPR was an attempt in that direction, it wasn't enough of a hint to software developers, that's how we got the Cyber Resilience Act that's beginning to take first effects in a few months.