In principle perhaps _Chaz_ but fixing things takes time and effort and companies have been known to sit on things for many years (companies as lazy as the these have just been demonstrated to be on matters of security even more so). A nice case study might be that of locksmiths if not only because they were secretive for a long time (see the likes of lock bumping) but that they are in a very similar line of work and have been around for several hundred years at least and MS have a long history of such things as well.
Certainly timing (expecting a fix in a day), level of released information (general idea through production grade exploit) and other such concerns when it comes to releasing results of research it is a matter of huge (and ongoing) debate among security researchers.
Also consider there are some extremely talented people doing the car theft bit (by no means all of them but some of them have insane skills) and they can and do quite happily generate their own exploits.
At this point I am not debating the finer points but a blanket statement such as yours might not be the best thing.
Far from anything I would consider definitive but
http://googleonlinesecurity.blogspot.com/2...sure-focus.html has a few good points to use as a jumping off point.