There are many questions in your question, maybe more than you want, but I will give it a try.
Why is there a lack of security in many IoT products?
There are two reasons:
- New companies on the market without know-how.
"Each cent counts"
There are many new companies on the market. They are developing toothbrushes, hairbrushes, bulbs and so on with the target: Internet of Things and bring it on to the consumer. So let's say we have an intelligent hairbrush from L'Oreal (yes, this is real shit). They say okay, lets make a hairbrush and an app because the boys and girls should know all about their hair. But the hairbrush has to cost at most $15. Sorry bro, no money for security. And furthermore these companies are not Microsoft, Google or the like which have years of security engineering and good engineers.
As I said above, this goes hand in hand. You need to sell the hairbrush. Apart from that, that I don't need it, the target is that people buy it. And the main factor is the price. When the company is talking about the price, there is no place for security in hairbrushes. Main focus on production, marketing, ... Others than for example, when Lenovo is producing a notebook.
How to secure my "Smart Home"?
You need to know: You will have many protocols, you will have many gateways and many products are insecure. Furthermore they want access to the internet. Of course, there are products on the market which do not need an internet connection. I recommend those, but be aware that you think of the next step:
How to update? Do they want, that I update it manually?
There are so many insecure things in the internet. A few month ago someone wrote a script with about 100 standard credentials and had one million IoT in a very short time.
Of course you can put a box in front and watch the traffic. If you have the time, but this cannot be the solution for all consumers. This brings me to the next point.
For a better security in your smart home you need to tell us which things you are using. There are products with telnet access, standard passwords and so on, that it is hard to say, how to make it secure.
Just don't message to the internet from your smart home?
Sounds good, but is not really possible. It is pretty simple: A company wants the data to sell it or to inform other companies. That means you need to create an account for your new IoT product and without that account and the connection the IoT product is not working.
"I don't care what they should do with my data". Often heard, but the cases, where this is misused are increasing.
That can be good [future scenario]: For example a hospital knew which drugs you need.
That can be bad: The insurance will ask you: Why you didn't take the drugs on 7a.m.? We pay nothing.
Are we as consumer responsible for anything?
Back to the security. Are we? Certifications, validations, encryption ... don't even really exist. DDoSing, the bad things of IoT. The consumer isn't interested in security. He is buying the hairbrush and is checking the app if all is clear. "My SmartTV is DDoSing a bank in Mexico?" -> "I don't care, hopefully it recorded the football game last night."
You need regulations for all that, so you need the state to talk about that. But if you have high regulations, a hairbrush will cost $40 and not $15. IoT is coming in big steps. E-Sim, Smart home -> smart cities, etc.
Sorry for the hairbrush I focused on. :D