Sploits used by state actors are typically novel, expensive, and niche. It's extremely unlikely criminals would have them, so it's a false equivalency. "Must be

Sploits used by state actors are typically novel, expensive, and niche. It's extremely unlikely criminals would have them, so it's a false equivalency. "Must be fixed" without considering the "what," "why," and "by whom to whom" isn't realistic. Let's suppose some terrorists are working to hack into your and many other Teslas to crash them on the highway. Would you really prefer a CT operation continue to identify the culprits using vulns or would you rather you and your family crash into an overpass support? Infosec doesn't exist in a vacuum; there are real-world consequences to thwarting legitimate CT operations due to a strict, unyielding adherence to a "patch everything right now" religion.