I've worked on autonomous driving / ADAS, and have read a few university lectures on related software engineering subjects. On one occasion, my presentation was followed by that of a military researcher whose job is basically to study new threats enabled by digital technology.
To my surprise, the military researcher wasn't particularly concerned about software vulnerabilities in cars and similar vectors. We discussed some specific instances of remote car software exploits. His point was, in essence, that all cars with advanced software can potentially be exploited, but that it's not a real threat because all such exploits require special knowledge, equipment and money. For someone looking to assassinate a specific individual, there are far cheaper and simpler methods that are also more reliable, including several methods that involve physically tampering with a car. For someone who wants to cause mass chaos, such as attacking many vehicles in an area, the researcher estimates it requires the capabilities of a state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos.
To my surprise, the military researcher wasn't particularly concerned about software vulnerabilities in cars and similar vectors. We discussed some specific instances of remote car software exploits. His point was, in essence, that all cars with advanced software can potentially be exploited, but that it's not a real threat because all such exploits require special knowledge, equipment and money. For someone looking to assassinate a specific individual, there are far cheaper and simpler methods that are also more reliable, including several methods that involve physically tampering with a car. For someone who wants to cause mass chaos, such as attacking many vehicles in an area, the researcher estimates it requires the capabilities of a state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos.