The thing is that many IoT devices aren't simply updated. The industry doesn't work like software development countries.

They usually think in projects. Some project manager, some funds and some workers are assigned to a specific project. And than this project is followed through. Eventually the project is done (finished or dismissed). And all the allocation shifts to the next project.

This is e.g. the reason why most of the Android phones have so bad security. Even Qualcomm does the Android stuff on their chips only project wise. Is the project done, then you'll get an Linux kernel from 2021 with this specific device. There will never be an update, even if this outdated Linux kernel has 20 known CVEs. The reason is simple: no PM allocated, no funds allocated, no workers allocated.

And such project-thinking also exists for other hardware chips, e.g. network or WIFI chips. Lots of development to get the thing "ready to market" --- which isn't necessarily to get it good --- and then almost nothing.

And this is the hardware the industry automation uses. Except that there some intermediaries in between, e.g. Kontron that make industry-grade boards. But even at that level you have the project structure. These boards are then used by the manufacturers of the industry automation which, who would have thought it, also mostly think in projects.

And this is the reason why the S in IoT stands for security.

People at various levels would need to switch to a process mode, away from project mode. And people at various management levels need find a way on how to sustain this financially.