Smart meters are deployed in massive numbers and maintenance/upkeep of flaky units is an intractable problem. They are BOM-constrained products. So they tend to use dirt-simple bulletproof embedded processors; mostly, MSP430.

So provisioning "2048 bit keys" (more realistically/reasonably: aggressively small ECC keys) is not as simple as pulling them out of the air and assigning them.

On top of that, and for the same reasons I mentioned above, smart meters tend to communicate over very simple RF protocols. There isn't a lot of headroom in those protocols for large moduli or, for that matter, for many round-trips.

I'm not arguing that these systems should be more secure. They obviously should be. I'm disputing that securing them is an easy problem. It is not.

Later

(There are better smart meters, as someone mentioned downthread. But remember also that it is very, very difficult to get cryptography right. It has essentially never been done in the first major deployment of any system.)