What baffles me is that, when I bought insurance for my car, the insurance company asked me if it's equipped with an immobilizer, explaining that it gets a disc

What baffles me is that, when I bought insurance for my car, the insurance company asked me if it's equipped with an immobilizer, explaining that it gets a discount if so. It is, and I answered as such, but why wouldn't they have known that already based on the VIN? I profoundly doubt that most consumers know the difference between a key, an immobilizer, and a steering wheel lock, for instance. Furthermore, I'd imagine most Kia drivers assumed theirs were likewise equipped, and answered as such, and paid the lower rates associated with immobilizer-equipped vehicles despite the precise opposite being the case. If the insurance company had known which models didn't have immobilizers, rather than taking customers' incentivized guesses as data, word would quickly have spread that "these cars are cheap to buy but crazy to insure", and the market might've had a chance to pressure Kia into doing the obvious. Fundamentally, I think insurance companies dropped the ball on quantifying the risk. And I hope we see substantial investments in cybersecurity analysis by the insurance companies going forward, it's the only way the market can function.