The "problem" is really that the need for security became obvious in the web/networked world first. Think back to how insecure devices were 20 years ago. That

The "problem" is really that the need for security became obvious in the web/networked world first. Think back to how insecure devices were 20 years ago. That security is slowly trickling down to other areas of the software industry. Even when you have individual engineers or teams who understand that it needs to be more secure, their procedures don't have that built in. And securing the car needs to be done at a system level, which means coordinating across suppliers & subcontractors, which requires management buy-in. Similar problem in the medical device industry, but at least we have FDA cybersecurity requirements to adhere to.