I suppose if it’s being actively exploited, the next step would be to make users wait a day, like the plan to change how Android side loading works.

I'd be absolutely livid if my browser asked me to wait for a day before letting me firmware flash whatever new USB gadget just arrived in the mail.