Earlier quoted context omitted.
Insurance companies should reflect unlock vulnerability of a car model in its premiums. That still leaves the problem that few people look at insurance premium when choosing what car to buy. What would help is a widely used certification system kept up-to-date by certification authorities in cooperation with insurance companies, similarly to what we have in place for a car model's fuel consumption.
This penalizes unaware pre-existing car owners. Not only they got a crappy car, they now have to pay more for it - all because the vendor was sloppy. Doesn’t seem fair to me. The responsible party should be the automaker that built or installed the security system, not the person who was sold a lie.
Flipper, lock picks, bolt cutters, etc. are all reasonable tools. So is the expectation that using them to commit a crime should result in penalty for the individual committing a crime using those tools, not the target of the crime they are committing.