> You could argue why isn't the car just doing it because they're at a standstill and it should be safe to do so? It's probably a sane default in case there are no sensors / no velocity reading / etc.

So the argument is that even with critical sensors offline or not providing meaningful data, the automation should continue to operate as normal? I believe Boeing has said much the same. The outcomes they've had by it lead me to doubt the merit of the argument.