> I don't think it does outweigh the benefits

Fine, but that is the real discussion to have. Not 'it has this risk and therefore is bad'.

> banning vendors that do not secure their devices

I think the goal is to encourage positive behavior, not try to monitor everyone and evaluate their updates.

> promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law

I imagine the law is more than just one clause ?