How do so many vulnerable IoT devices stay alive and online

Question

There are reports of millions of vulnerable IoT devices still being used despite known security flaws.

• Why aren’t these devices automatically patched or deactivated?
• Do manufacturers fail to provide firmware updates, or are users just unaware?
• What role do botnets play in keeping these devices connected and operational?

I’d love to understand why outdated and vulnerable IoT devices remain active instead of being taken offline.