If I want my IOT garbage to be infected that's between me and my local botherder.

The vendor loses the right to decide how my things are used the minute they take my money.

Not in the EU. If devices you made get hacked in the EU and you have a business presence there, you're liable for the resulting damages under the Cyber Resiliency Act. If you don't notify the authorities promptly upon discovery, you might also be criminally liable.