I agree with many things you say, but this ain't one of them. An autonomous car does well to stop in the lane because that's obviously better than barreling down the road and hitting something. But stopping in the roadway is very definitely in the category of Unsafe. In my state, it's even legal under certain circumstances (accidents, emergencies, etc), but that doesn't make it safe. Even stopping on the shoulder is unsafe, and folks die that way.
I don't mean to be pedantic here. Driving is inherently unsafe, but stopping on a highway is orders of magnitude worse.
I appreciate your thoughtful comment as always JB. In this case, I apologize as I may not have explained myself properly. Let me try to clear it up.
Advanced L2 (like Tesla) systems are driver assist, where the driver is in full control of the vehicle, and letting the car handle some of the driving tasks while being completely alert and ready to take over in an instant if required by the system (red wheel alert), or to correct a bad decision from the ADAS system.
L3 systems (like Mercedes) are also driver assist, with more of the driving tasks being handed off to the car to the point where the driver can take focus away from the road until the system requires them to resume control with a small warning window (usually 7-10 seconds).
In both cases the car is not autonomous, has a limited ODD, and still requires a driver in the driver's seat to handle driving tasks when required. And, in both cases, has a specific safety protocol to handle emergencies. Now, let's talk about how both handle emergencies:
Advanced L2, while enabled, will periodically check to ensure the driver is paying attention. This is accomplished through steering wheel torque (Tesla), Eye Monitoring (Tesla, Mercedes, and many other manufacturers with Lane Keeping + Adaptive Cruise Control), or steering wheel contact (typically capacitive sensors on the wheel). If those systems do not detect a driver, or the driver fails to comply with the requests to confirm attention, the default position of the car is to assume the driver is dead. This is the "lowest common denominator", and highest safety margin the car can provide. Since an Advanced L2 is limited in its ODD, it does not have the capability to safely change lanes, exit a freeway, find a safe parking spot and park the car on its own, without a driver to take over in the event of system error/failure/unanticipated maneuver/poor interaction with other vehicles/etc. Forcing the car to attempt this could end up creating a much worse situation than its default behavior, which is to engage the hazards and slow the vehicle down to a stop in its lane.
L3, while enabled, does not require driver interaction or attention, but does have a limited ODD, and does require a driver to take over when straying outside the ODD. Once the system determines it is straying outside the ODD (such as traffic lightening up and moving faster than 35MPH in the case of Mercedes), the car must hand over control to the driver with a short warning (typically 7-10 seconds). During those 7-10 seconds, monitoring systems engage to ensure the driver is paying attention, including capacitive wheel sensors and eye tracking sensors. If the driver fails to take over after the warning period, the car's safety protocol engages, like the L2, and assumes the driver is dead. And also, like the L2, the L3 system does not have the capability to safely change lanes, exit a freeway, find a safe parking spot and park the car on its own, as this is outside its ODD. The safest thing for it to do is to engage the hazards and slow the vehicle down to a stop in its lane.
Yes, I agree with the points made here that the best, safest solution is to change lanes, exit the freeway, and find a parking spot. However, this is beyond the ODD of Advanced L2 and L3 systems. They are not designed to be autonomous. This is the purview of L4+ systems. However, even L4 has an ODD and in some cases will simply engage the hazards and slow to a stop in its lane.
Does stopping in a lane with hazards blinking cause a potential safety hazard to drivers around it? Yes. However, this happens all the time with human drivers with non-ADAS cars. It's common to see a car stopped on the road, with cars slowing down and changing lanes to go around them. This is usually for an accident, or mechanical failure of the vehicle, but in some cases can be for a medical emergency too.
I will preface this next point with the fact I have not researched various laws in every state, but using a standard "reasonable" test, I would imagine that every state allows for emergencies beyond the driver's control for them to stop in their lane, such as a mechanical failure or medical emergency. The only requirement would be, if the driver was still conscious, they put on their hazards. I'm guessing the laws/rules would state something like "where possible, pull over safely." The operative words being "where possible".
Now, does that make the L2 and L3 systems, with their limited ODD, unsafe if they cannot hand back control to the driver? My argument would be no. They are acting reasonably in a potential emergency, where they assume the driver has died, and they cannot safely exit the freeway and find a parking spot. Trying to do so, or just continuing at speed in their lane, could create a much worse situation than stopping with hazards flashing.