The problerm isn't the architecture in the vehicles - most 'modern, connected vehicles' use FlexRay rather than CANBus, FlexRay behaves more like a packet switched network, only sending (or more accurately, modules only listen 'in turn' based on the timing packets) data to the modules that need to know, whereas CANBus is more like having a Token Ring network. FlexRay networks usualy have a security module, variously called 'Firewall', 'Gateway', 'Vehicle Connectivity' or 'Keyless Vehicle' {an oxymoron] modules, these quite properly validate signals received against stored values and authorise the specific modules to carry out the required actions.
Where this all falls down is when Programmers design & implement API's in isolation, preferring to run them past Marketing rather than Engineering....
Where insecurity HAS to be baked into the vehicle, it's generally the 'consumer focus groups' to blame, wanting features such as Keyless Entry (!), powered tailgates where you can wave a foot around under the rear of the car so you don't have to put your shopping / dog / child down to get your keys out - much better to pirouette around on a frozen car park.... All this means the vehicle is effectively an antenna farm to rival the old LF one near Rugby just so some entitled prick doesn't have to push a button on a key and then have to suffer the ignominity of turning a key blade in an actual lock!
Biting the hand that feeds IT
