LLMs have been pretty good at breaking bad crypto in cars. In my Hyundai, they were able to figure out the right incantation to get the car to run unsigned code off a USB stick. Although I guess we're in trouble once carmakers use LLMs to lock things down even more
Most shop security is security through obscurity. For them to lock it down, they need to manage those secrets all the way back to a cloud identity provider. They can and probably will do that eventually.
I assume Tesla does that already.