The primary code needs to be published, and the publication kept current (versioning). I don't know what kind of open source license is well suited to this that also limited reuse and use modification since those things can open a liability can of worms potentially. But the idea that code applying to the primary control functions of an automobile cannot be known (is not published and cannot legally be reverse engineered) is just a bad idea. Consumers are injured, the environment is damaged, and arguably even a bunch of shareholders and national pride are damaged because none of the participants had a say in VW's decision. Well, they get a say if the code is published.
User apps and UI/UX code I'd say can probably be proprietary, closed, and not published.
User apps and UI/UX code I'd say can probably be proprietary, closed, and not published.