I too have worked with major automotive OEMs, and all the 'security' I've seen is nothing but lip service. The quality of embedded software in the automotive world is laughable. Forget anything advanced, they're just getting into the what-do-you-mean-bounds-checking stage of computer security.
There's just starting to be real external research into the current state of the automotive world: http://www.autosec.org/pubs/cars-usenixsec2011.pdf
Even the proposed new standards are busted: http://publications.lib.chalmers.se/records/fulltext/143639....
I for one, am going to have a hard time buying any car made after 2006.