These safety modules sound really complicated. Let's say a security vulnerability has been discovered. An attacker has wormed their way into as many cars as th

These safety modules sound really complicated. Let's say a security vulnerability has been discovered. An attacker has wormed their way into as many cars as they can. They send a 'go' signal from their command and control servers. Across the world, cars start looking for opportunities to kill their passengers and bystanders. We send the shutdown signal. The safety modules wake up and take over from the compromised computers. What do they do? They could brake. However, the car might be in a turn, on a rainy day. Braking could send the car into a skid and kill its passengers. Maybe they brake, but slowly. However, the car might be behind someone who just suddenly changed lanes and slammed on the brakes. Braking hard might be the right move in that circumstance. Maybe they do something conditional on the sensor input they get. However, if the control computer can do something to 'blind' the safety computer, that doesn't help. For example, can the control computer issue firmware updates to the camera sensors? Can the control computer fill a sensor's bus line until it can't respond? I can't think of any solution to this that doesn't involve duplicating a substantial part of the control computer.