> the cost is $0 > at most a couple of meetings and a junior dev spending 30min watching the first three YouTube results for "consumer device security issues", and then another 30min copy/pasting standard mitigations into place.

That's not $0 in my math. That's a total effort easily worth of a few thousands if not more from all aligning parties.