I think the challenge here is figuring out how regulators and insurers can tell the difference between best practices and things like security theater or former best practices that are now obsolete but are written into regulations or standards.

Right now there are only ~250 car models available in the US. Each one gets incredible amounts of attention from all sorts of people, both before and after launch. And cars are pretty stable technology. But there's a ton of software out there: 1.8 million entries in Apple's App Store alone. And our tools and technologies are still evolving at a rapid clip. Having to explain each new library to an insurance company functionary sounds like a major brake on innovation to me.