Yes, and so far it's much easier to drive a van into a crowd of people. Nobody has tried to mandate tech in cars that detects and prevents such malicious behavior.
It's probably totally doable by now. We literally have self-driving cars.
Even without vulnerabilities like that, something like https://comma.ai/openpilot could very likely be used in the same way ArduPilot was used in the recent Ukrainian drone attacks.
a van is just a bigger, more inherently stable drone.