Having given this a lot of thought, regulation is important and devices going out of support should open up their source, but ISPs are the chokepoint and should be both supported and motivated to enforce security measures to protect the rest of the internet from the botnets that are being operated from their networks. There is no perfect solution, but I think that’s a start.