I agree with you, I'm just not sure how you'd wright the law that makes them clear the low bar when that bar might need to move up before the bill even becomes a law. That's why I would prioritize some kind of "security update bill" instead of trying to legislate the low bar that needs to be crossed.
Nobody's demanding that auto manufacturers build a secure system, we are just expecting them to meet an incredibly low bar of security.
The manufacturers in question, unlike their peers, have failed to clear it.