I wonder if this could be a step in the direction of forcing manufacturers to allow custom/open source/audited software in all vehicles. If it can be done in some foreign-made vehicles, it can be done in domestically made ones too.
Also note that it says "connected and autonomous vehicles". If that means two categories, "connected vehicles" and "autonomous vehicles", it could be quite broadly applied to vehicles that download updates over the air. If it means "autonomous vehicles that are connected" it could be somewhat narrow and an easy work around is to leave the autonomous vehicles disconnected from the internet. I'm not sure how much self-driving abilities are run on servers?
Good point! If vehicles are communicating like that, which I've always thought would be the ultimate for efficiency, you'd have to protect against poison pills. That would be even more difficult with disparate systems cooperating.
Reminds me of the car "chase" scene in I, Robot.