I wonder if there should be a way to permanently disable the camera via hardware switch.

Similarly, there should be a way to disable any kind of autonomous driving via hardware switch. in other words, it should be technically impossible to control the car via software once the switch is engaged.

I know, CAN bus devices are all controlled by the software, but these two subsystems must be isolated with something like an RS-232 link and a very conservative protocol between them.