Is it really too much to ask that apps/devices are made secure from the ground up?
In a way, yes. They can and should definitely be made with security in mind from the ground up. But they will never be totally secure, and a necessary part of what constitutes a “secure product” is to continuously and quickly patch security issues as they become known.
Surely that’s just a secure end-to-end encrypted connection?
I would bet it’s still a bit more than that. But even if it’s just a secure end-to-end encrypted connection, here is the list of vulnerabilities fixed in OpenSSL (which is probably what they use for secure encrypted connections). It’s five so far in 2024. Then there’s some OS kernel below that which can have security issues as well. The Thermomix probably also has user authorization components and payment methods, plus various personal information that has to be protected under GDPR.
No argument there. But apparently there’s a market for it.