Consumers have no idea about security, the risks, the technology, how to evaluate it, or who to buy from. That is not a realistic solution.

Consider food or automobile security: Should consumers somehow evaluate them? Check the wiring? Find out, at every restaurant and grocery, how long the food has been stored and where?

IoT security has another issue: It can affect others more than the end user. If my IoT is DDoSing you, what will the market do about it?