It provides a good incentive for manufacturers to invest into security for their devices.

No, it provides no incentive at all!

It's the users who suffer when this happens, not the manufacturers. The manufacturers couldn't care less, the money is already in the bank.

If the manufacturers were required to replace all the revoked devices at their cost, that would be a real incentive.