Generically (and IMHO) the original "bad" idea remains that of mixing together the actual "security related" and "vehicle operation" items with the entertainmen

Generically (and IMHO) the original "bad" idea remains that of mixing together the actual "security related" and "vehicle operation" items with the entertainment and navigaton system AND allowing external connections (via SIM or similar, OTA and the like). It is just like most computer vulnerabilities, the ones requiring physical access have in my opinion an almost null impact in practice (if such a physical access is made difficult or impossible), whilst anyhting "remote" is really preoccupying. One of the suggested mitigations of putting the OBD-II connector inside a hardware locked case (presumably with a mechanic lock with key, IMHO safer than an electronic one with a password) goes in this direction, no physical access, less risk.