This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assistant" in the local press. This list circulates, and since nobody in the middle management wants to be responsible for anything, and there is no officially approved positive use case, draconian countermeasures are drafted and constructed one by one.
Except when it’s about privacy or anything else we actually care about: then absolutely nothing is done because it would cost more than 0 to do anything.
It's pretty sad that "User used their product in a novel way we didn't expect" is seen as a risk that must be mitigated.
I hope I won't be in one of those cars when the in-memory encryption key gets bit-flipped by the unfortunate cosmic ray.
https://en.wikipedia.org/wiki/2009%E2%80%932011_Toyota_vehic...
They appear to have seen making their Home Connect platform open as at least in part a matter of compliance with EU data transparency and portability laws.
Take a look what the automotive risc-v people are working on or the requirements of the EU cyber resilience act.