Can a car manufacturer be held responsible for built-in features designed to maim or kill unauthorised users?

If he put the malware in, yes.