> there are typically no legal requirements
Not after EU CRA https://en.m.wikipedia.org/wiki/Cyber_Resilience_Act goes into effect