[IAmPym]

I can't see this changing much if they water it down to a point where liability isn't an issue. If a company is weighing whether to put resources into a security update vs. roll the dice on whether they are used as an attack vector, where they will be sued and just declare bankruptcy, I don't think it would be effective.

Doubly so if their products are still in use after the company goes under. Now who is liable? What protections can one create for this scenario?

Most consumers will never file a lawsuit against such behavior because it is an incredibly uphill battle.

I get the sense that regulation like this will just create a new goalpost that won't ultimately help consumers, we've seen it happen time and time again, but I don't have a better idea. I suspect if you tried to enact real change you'd get too much opposition.

Tricky situation.