Sounds like Tesla worked with these guys to patch this for all owners before it was disclosed. And they hired Chris Evans from Chrome/Project Zero to lead security. To me those are signals that they take this seriously.
I was developing entertainment system for Volkswagen's cars a while ago. At the time their cars have several networks interconnected with a simple firewall. They were separated into domains, if I remember correctly it was core (engine, steering wheel), first level (reporting, airbags, etc.), second level (opening windows, etc.), and then entertainment system.
The firewall was one-way. Systems on lower level are able to intercept some messages from higher levels, but are unable to send anything to higher level (with some exception between core and first level). That also means that the entertainment system is unable to open/close windows for example - you have physical buttons for that.
It was a while ago and my memory is rusty. But you get the idea that car systems can be build securely with competent engineers.
Jeep remote exploit: "OMG, are you kidding, what kind of idiots would even allow this to be a possibility? Car control systems remotely accessible, etc?"
Tesla: "Kudos to Tesla for taking this seriously and working on it."
How is it that we can be repeating the exact same mistakes made in software over the past 40 years, without anyone questioning whether the dangers of cloud-enabling cars is remotely justified by the features provided?
1) The features provided by Tesla extend far beyond those provided by "cloud-enablement"; the fact that "informed consumers" are buying the cars does not indicate that their purchasing decision came down to isolating cloud-enablement relative to cloud-features.
2) Your hypothetical informed consumers don't really exist, unless the only people buying cloud-enabled cars are computer scientists.
2) Ever looked at a tech company parking lot in South Bay? A lot of people with CS background are buying the Model S. Not all buyers are computer scientists but informed buyers most definitely do exist.
Of course, even being informed isn't going to help if this sort of poorly secured connectivity becomes the norm for new vehicles, which seems to be happening disturbingly quickly. If you rely on the independence offered by having a car but all cars have similar dangers, you might have only bad alternatives to choose between, but they're still bad.
[Edit: That last sentence was ambiguous. My intended meaning was that the alternatives to using a car at all might also be bad, for example incurring significant costs and disruption moving to live somewhere with viable public transport instead.]
So let me get this straight ...
They were able to plug in a laptop into the car and gain control. In fact, physical access is necessary.
Tesla used the cloud connected features to update the software, removing the physical vulnerability.
Yes, the connected nature of the car is an attack vector. But it seems there are other attack vectors which are far worse and the connected nature can be used to protect the vehicle.
We need to be careful with this kind of risk assessment.
If Microsoft or Google messes up a Windows or Chrome update that is automatically installed, or a malicious actor compromises the update mechanism, maybe a few thousand PCs belonging to people who accepted the risk get broken and there will be some hassle restoring normal functionality afterwards.
If a car manufacturer messes up a firmware over-the-air update that is automatically installed, or a malicious actor compromises the update mechanism, maybe a few thousand cars belonging to people who accepted the risk get run into walls at 100mph.
It is far from clear that providing a mechanism for remotely initiated updates of fundamental system software is a win in this context. As we've seen with automatically updating PC software in recent years, not all updates work as intended, and as we've seen with modern malware, reprogrammable firmware is not always a blessing.