I feel like the problem is a lack of realism about what is required to meet the usability standards of traditional analog switches. Like, I hear you talking about a tradeoff between security and usability for a "rare" provisioning event but I think in practice if you imagine a device has a 10 year lifespan, I would guess that making the provisioning hardware probably translates into at a minimum a full month of downtime over the lifespan of the device, with many devices being down for months or years at a time because no one can be bothered to figure out why.
The security concerns probably have typically zero impact on the operation of the device. I'm not saying that the security concerns are unjustified. Really I'm actually leaning more that this is completely impractical and not a good replacement for a dumb physical switch. The security issues are unacceptable and the downtime caused by even the useless security measures available is even worse. (Also, the security measures seem more concerned with whether or not I have a license to watch my video on that particular device than preventing people from turning on my toaster.)
> if you imagine a device has a 10 year lifespan, I would guess that making the provisioning hardware probably translates into at a minimum a full month of downtime over the lifespan of the device, with many devices being down for months or years at a time because no one can be bothered to figure out why.
Can you explain more about how you reached this conclusion? Why are devices offline for years now?
The Bluetooth connection gets screwed up for some reason and it needs to be reprovisioned. The device is in a room which isn't really the domain of the person who can reprovision it. Whoever is actually affected by the outage can't fix it, has to realize that it's a solvable problem and ask the person who can solve it to fix it. This social problem of recognizing that a chore needs to be done will likely take at least a week, typically a month or even years to resolve.
And the whole point of this is to provide a seamless experience that's easier than using a physical switch. But in practice this just generates chores that are actually more time-consuming than simply using a physical switch. (Even in the single-user setup, I can imagine that I actually just revert to using whatever hardware controls are available on the device for quite some time because reprovisioning it is too much of a chore, and whatever wireless options it provides are not worth doing that chore.)
The security concerns probably have typically zero impact on the operation of the device. I'm not saying that the security concerns are unjustified. Really I'm actually leaning more that this is completely impractical and not a good replacement for a dumb physical switch. The security issues are unacceptable and the downtime caused by even the useless security measures available is even worse. (Also, the security measures seem more concerned with whether or not I have a license to watch my video on that particular device than preventing people from turning on my toaster.)