Technology

People who want to prevent their devices from being swept into botnets should install security updates in a timely manner and resist the urge to continue using software or devices that no longer receive them.

That doesn't really seem likely to happen on its own. I'm pretty sure that most IoT devices phone home and upgrade themselves (which, frankly, I'd be maybe more-concerned about as a vector than a lack of updates, since anyone can buy a defunct IoT maker and thus get control of all those devices, or penetrate the IoT maker's network) and I imagine that most people have no idea when a device has last been updated.

You can maybe have some sort of network protocol where devices can report their last update. That'd maybe permit for auditing that, if you had a device that would tell a user about an outdated device, which isn't really the case today. Also kind of hard to tell an end user what a device at IP address X is. If they're on the same Ethernet segment, maybe could try to identify it by OUI on the Ethernet MAC address, I guess, but that's not going to give you a convenient helpful-to-most-end-users product ID for a lot of devices. So if your audit program sees a device on the network that doesn't implement the "last updated" protocol, it may have a hard time identifying it to you in human terms.