A zero-day attack on legacy business software explains why insurance regulators and millions of customers face ongoing risks