Insecure websites to be named and shamed

Note that the last link there allows you to enter a URL and run the tests yourself. Probably useful for those wondering if they will be caught out.

If you go here it has some recent scans: https://www.ssllabs.com/ssltest/ and you can check your own site.

Most laws and regulations require a site to provide "reasonable" and "adequate" protection. While those are loaded legal terms it is generally interpreted in such a way that a site should be proactive enough to be updated against known and patched vulnerabilities. It looks like TIM is reporting on those -- I didn't see any zero-day stuff -- so, to answer your question, I think TIM has a very defensible position if faced with a suit.

Article's changed now - the BBC quite often make adjustments to the text after it's first published.

probably depends on what kind of contract terms your jurisdiction is willing to ignore on principle, as you almost certainly signed away all such rights when you bought it.

Most of these SSL misconfigurations has nothing to do with certificates.