This is probably less security theater and more not-getting-sued theater.
Sued for what? It's rather the manufacturer should be sued for selling insecure vehicles. And slapped by authorities too.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
But the practice is far too commonly to sue the discloser rather than the manufacturer of the software.
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing