At the end of the day, lack of competent security leadership at Hyundai. In my work with other auto OEM's, there is some kind of security officer assigned to a vehicle model or platform that specifies requirements and that requires formal attestations for things like private key material, SSL cipher suites, process isolation and so forth.

At the other OEM's I have worked with, private key material lives on an HSM controlled by the OEM and all signing/encryption is done by the OEM for production builds.

If they are using example keys from NIST and private keys from published tutorials, then I would not be surprised if they are also using defaults for TLS - for example: allowing TLS 1.0, allowing TLS 1.1, allowing weak cipher suites, etc.