Clarification: this is a vulnerability in the Internet of Things component attached to the car. The car itself fine, and the vulnerability is only in devices with the silly and expensive IoT upgrade package.