You're ignoring the possibility of a mass-exploit, meaning the kind of cheap exploit that affects multiple vehicles at the same time, possibly killing a bunch o

You're ignoring the possibility of a mass-exploit, meaning the kind of cheap exploit that affects multiple vehicles at the same time, possibly killing a bunch of people, destroying infrastructure, or stopping the flow of traffic. Your typical adversarial "single pixel" change that makes your network believe unreasonable things, but in the real world. The existence of such exploits has already been demonstrated.