I think no country can be trusted and therefore all IoT device communication (telemetry/updates) should go through government-controlled local servers in an unecrypted form. This way local government can enforce its policy over foreign manufacturers and has a "kill switch" if they misbehave.

Also, all communication and telemetry should be opt-in and turned off by default.

Government-controlled server would prevent foreign countries from collecting intelligence and pushing malicious updates.