It's an open secret in the industry that the CAN bus is not authenticated. If you connect, you can read the data on the bus and inject the data on bus.

But, that does require physical access to the car and hooking to the wires. Nobody complains that if you hook to the buses on a PC you can own it.

Now they have this security concept where every ECU on the car will have their own private key in their own secure enclave. You need that key to put authenticated data on bus and it can only be updated by the OEM's.

The authenticated bus infra will probably not protect against remote attacks ( since if you own the ECU SW you have the cert and you will still be able to publish signed messages) but will kill ability to change HW.

I really would not like to kill our ability to fix our vehicles but I feel this is the thing that is going to happen.