But paying quality engineers isn't fun and they won't work for idiot management. So as long as management doesn't have to pay for the cost of disasters they cause, nothing will be secure.

It's the same thing that happened at Hillary's State Department.

So I agree: Brick those refrigerators.

Also while this attack did involve a botnet which used default credentials there will be attacks that infect via RCE or any other unauthenticated vector or simply don't require a botnet at all like say adding a multicast IP address to some wificamera or telemetry device that would cause it to send its traffic to a victim of your choice.

At the end you want to make sure your network and services are resilient to DDoS attacks, securing the endpoint source of choice everytime isn't that good of a strategy.