It is isolated on a separate CPU for the infotainment system. However, that same system hosts the UI to configure the drive system (suspension height, range/power tradeoffs, traction control) so if you pwn the infotainment system you can attack the drive system over the car's internal Ethernet.
And that's not proper separation ;-)
At least they seperated airbags, breaks, steering etc, so you can still safely stop the car.