LLMs have been pretty good at breaking bad crypto in cars. In my Hyundai, they were able to figure out the right incantation to get the car to run unsigned code off a USB stick. Although I guess we're in trouble once carmakers use LLMs to lock things down even more
Most shop security is security through obscurity. For them to lock it down, they need to manage those secrets all the way back to a cloud identity provider. They can and probably will do that eventually.
Old news - for 20+ years in Europe, 5-10 years in the US, and now in Korean and Japanese cars too, ECM updates have been cryptographically signed for warranty, emissions, and now EU cybersecurity regulatory compliance. It turns out there are still bugs in things with cryptography too though.
I assume Tesla does that already.