Governor of California, Jerry Brown, has signed a law on the Internet of things that covers cybersecurity. California is the first state with such a law.
From 1 January 2020, any manufacturer of a device that connects "directly or indirectly" to the internet must provide "reasonable" security features designed to prevent unauthorized access, modification or disclosure of information. If it can be accessed with a password outside a local network, it must be supplied with a unique password for each device, or force users to set their own password the first time they connect. That means no more generic standard references for a giver to guess.
If it only affected all IoT devices, instead of those made two years later.
: California has just surpassed a Law on the Internet of Things