The blame falls on the car companies (and the thieves ofc)

They are still using rolling code technology when public private key exchange exists from the 70s. The have stagnated from anti theft technology while being in the bleeding edge of DRM and data collecting.

they profit from rediculous keyfob prices when a 2$ microcontroller can do the job

they have locked down the car so its impossible to modify

they are not doing recalls to patch the vunorabilities

they have lobbied against security research and threatened researchers with litigation