It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...

On the non-Australian side (the Sam Curry blog)

  After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.

and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).

Defamation/legal risk, even if such legal actions will be spurious