I was at a closed-door event discussing these labels about two weeks ago (right before the potential government shutdown/temporarily averted for now) - and it was non-attribution, so I can only describe my comments:
(1) the labels risk missing the reality that the Internet and cybersecurity are not steady state, which begs the question how will they be updated
(2) the labels say nothing about how - even if the company promises to keep your data private and secure - how good their security practices are internal to the company? Or what if the company is bought in 5 years?
(3) they use QR-codes to provide additional info, yet we know QR-codes can be sent to bad links so what if someone replaces a label with a bad link such that the label itself becomes an exploit?
I think the biggest risks is these we be rolled out, some exploit will occur that the label didn't consider, consumers will be angry they weren't "protected" and now we are even in worse shape because the public's trust has gone further down hill, they angry at the government, and the private sector feels like the time and energy they spent on the labels was for naught?
There's also the concern about how do startups roll-out such a label for their tech in the early iteration phase? How do they afford to do the extra work for the label vs. a big company (does this become a regulatory moat?)
And let's say we have these labels. Will only consumers with the money to purchase the more expensive equipment that has more privacy and security features buy that one - leaving those who cannot afford privacy and security bad alternatives?