Earlier quoted context omitted.
IIRC the amounts involved were absolutely pitiful compared to the reputational damage-- they were being paid on the order of $10/car/year.
What reputational damage? I know it's a number that gets calculated on cybersecurity assessment sheets, but I've never seen it being in any way connected to reality. Best I can tell, the actual reputational damage is almost universally $0. Security breaches are non-actionable oopsies - unless your product is literally preventing such breaches[0], it's going to be seen as a random event that has no bearing on customer…
Changing cars is a heck of a lot easier than a corporation ripping out software that they likely have a 3-year contract on, and would require millions in services on top of just eating the cost of the contract itself.