How Regulations Shape Security for Device Manufacturers