I think the instance owner would be responsible, but what if the instance is out of the state?

Unless the instance owner is on a visa, with a criminal record they could get him. But otherwise it’s hard to be enforced.

Maybe they could ask the app stores to ban apps in that states. Something like that

Also states could ask ISP blocking the main instances.

Also for home network I don’t won’t my IOT to have a real IP to the Internet. Using IPv4 NAT you can have a bit of safety by obscurity