You're both right in a way. Not having stuff up to date will definitely leave you vulnerable, but if the stories about Tesla's internals are valid, they are not expending the time necessary to ensure they don't write a boatload of security bugs in the first place.