In the race to the bottom support will not get a priority. People want cheap gadgets, but a connected device is likely to need updates at some point. There's also the issue that people want it to be simple to set up and that is likely to compromise security too. Default passwords will not be changed.

It might to help to use open source in these devices and have some generic service that can provide updates to the security critical software. But the big companies probably prefer to do their own thing.

ISPs could monitor for suspicious traffic that indicates that a device has 'gone rogue', but they may not want to do that. I've heard that some of the gangs running botnets of devices are patching them to prevent other gangs taking them over. It's anarchy out there!