You're comparing apples and oranges. It can both be true that security (and overall software) quality is poor, and that automated buggy cars are better than erratic people.

However, when you are considering system risk (e.g. that a bad actor could crash 100k cars at the same time) the worst case outcome could be much worse than the mean outcome.