it actually wouldn't cost the manufacturers that much, 90% of vulnerabilities are in software, so skilled developers could address a vast majority of the problems.

car companies don't want to do that, because that means they won't be able to have backdoor access to the car when they want to disable a "pay-per-use" feature, or have some proprietary service done that nobody else is allowed to do.

Probably quite practical if the insurance company made them