It's not 'they couldn't be bothered' more of a 'logistics' nightmare. Say you buy a car that has 'internal security via encryption'. Only the owner ( you ) wold have the access encryption 'key' to your car. Local dealer won't, local mechanic won't,the OBD-II reader won't, let alone the guy in the small town where you're broken down doesn't. Then it's not just ONE key... EACH CANbus device would have to have it's own key, and they all have to be allowed to talk to each other, on various 'levels' of access, can't have a 'master' or 'supervisor' key as that defeats the whole 'security' aspect. Then there's what kind of encryption tech do you use. DES128, DES256 are easy to hack with today's fast computers, so a portable PC can do it. Heck with wireless being in everything new, you don't need to be IN the car,can be done remotely.
99.999% of all 'data' files on a PC or smart device are not encrypted, so why should a car be ?