Unique private key per device, pre-provisioned certificate at manufacturing time, hardware-level separation of crypto operations so sensitive creds are never in memory.

It’s a bit more expensive to manufacture, in terms of BOM and logistics. And then you have a lot more complexity to your production system too.