At least there's an easy fix (as untenable as it would be to cause our government to do it):
1) $100,000 fine per incident of any unauthorized access to a vehicle through a remote mechanism (any mechanism, any access, no exceptions).
2) Force manufacturers to carry insurance to cover at least $1,000,000 in liability per car sold.
Problem solved... no more remotely exploitable surface for vehicles at all (too expensive for the manufacturer, until it's security-solid enough to afford the insurance). Won't fix general software bugs (which could still kill people), but would be immensely great for getting the scourge of telematic systems under control.