You can regulate the response time and the required infrastructure for the distribution of patches.

For manufacturers to actually listen to security research, you'd need regulation as well.

You could also require all or certain software in cars to be open source.