There really are too few business models available to build sustainable IoT solutions, apart from subscriptions (and only Security companies seem to have figured this out), pyramid schemes (letting your new users pay for maintaining the whole solution), or plain old planned obsolescence (with forced upgrades, like with Smartphones).

I'm not sure what models would work, apart from regulators stepping in and mandating x years of updates, like with the European regulations. Which basically comes down to #3.

Folks in corporate thought users would just love a garbage spyware app that reproduces functionality already available under the various home automation platforms - but with extra steps and pointless online requirements.

Then corporate finally realises that years of "user 000128571 locked door" log files are worth precisely f'all to advertisers.