If IoT becomes a security or safety nightmare, which I think most of us will concede as possible if not likely, there will be a public outcry that will result in either gov't oversight and regulation or the industry being sued out of existence. So, assuming for the moment that the IoT industry does not want to be suffocated by lawsuits, the real question for it is by whose hand regulations emerge and are enforced; the industry itself or the gov't?
Industry-based regs, e.g. UL.com, will be the least burdensome. But almost always an industry cannot self-regulate because of free riders, et al., or out of a short-term focus over profit maximization. So, in steps gov't regulation. And gov't regulation is very often over-kill, like using a bazooka to kill a fly. Said bazooka does result in a dead bug but also a lot of collateral damage to the industry being regulated. Think the FAA and how it's Part 23 regulations have both guaranteed safe aircraft and stagnated the general aviation industry nearly to death.
With articles such as this one and Gawker's "Why is My Smarthome So Fucking Stupid", it's pretty obvious that the IoT industry as a whole should be embracing and spreading industry-wide security, safety, and UX standards. Yet, for now there seems to be no such industry initiative to do so, leaving the task to Apple and, to a much lesser degree, Google. With HomeKit, Apple is forcing partners to adhere to tight security and usability standards. With its large user-base of ApplePay-enabled, willing consumers, Apple can force its will upon IoT partners going through the HomeKit acceptance process. But as if on cue, some partners, exhibiting short-sightedness, have whined to the press that Apple's process is onerous. While I'm sure Apple is more than happy to let IoT manufacturers not affiliated with HomeKit IED themselves through lax security or UX, for the industry it's a big mistake.