A car is manufactured and sold once to a customer, which then goes on a road rampage. (physical, discrete)
A website is continuously served and maintained by a provider to a customer, which then uses it for shopping scams. (virtual, continuous)
A spreadsheet serial key for an offline app is sold by the developer to a customer, which then uses it for embezzlement. (virtual, discrete)
Some legal questions: Is the manufacturer/provider liable? Did they know the product/service was purchased with the intent to harm? At what point can the manufacturer/provider be considered an accomplice? The product was sold already, what can they do about it? The service is still being provided, should they stop it?
I'm wondering how long until we see the physical, continuous scenario, exactly like the road rampage, but with a connected car. Should the manufacturer disconnect that car? Should they remotely disable it?
Very complex legal and ethical questions ahead in our times.