Just wait 6 months, and the IoT vendor will go out of business and shut down the cloud servers which will effectively brick the device.

That may brick it for its intended use, but nothing's stopping a botnet from repurposing it.

Good-guy botnet, cutting down on e-waste.

How about some good old tort liability

Absolutely not. They should be patched and fixed.

So they get to ship a dangerous device that harms innocent third parties because they cut corners, but we’re supposed to reward them by doing the work to secure the devices they couldn’t be bothered with?

Patched and fixed by the manufacturer, was surely what GP was suggesting.

Bricking the devices doesn't punish the supplier as much as it punishes the consumers.

Many of the companies that sold these devices have already bitten the dust, so they aren't even around to fix anything.