But seriously, there is a sunny side to this story: a user could load her own programs onto her SIM. She could gretaly extend the functionality of her phone... with programs that she trusts. Maybe even ones she wrote herself.
Imagine... an open platform. Oh gosh, that would be terrible, wouldn't it?
Otherwise this story highlights the concept of "minimum viable product" not in the startup world, but as it exists among major industry manufacturers. For example, if SIM manufacturers can get away with using DES, then why invest their time and money in using stronger crypto? There are so many examples of this type of thinking... it's certainly not limited to imlementations of cryptography or SIM cards. No doubt, some would say this is simply Business 101... ask any used car salesman. But it's particularly acute in hardware and software.
Do hardware and software worlds makers need higher standards and more serious "quality control"? Beyond the cosmetic appearance of their work, no. Because users are generally indifferent to all else. What they don't know won't hurt them.
Did you know you can type encrypted messages directly with a text editor called ed(1)? How cool is that? It's so easy. Who needs PGP?
It uses DES, but hey, DES is good enough for SIM cards, so...