I'd start by not using self-immolating wires (hardcoded default passwords).

Jokes aside, there's so much low-hanging fruit in IoT it's utterly ridiculous. Having any standards at all would be an improvement.