a) that will vastly reduce the level of usage, and b) the OTA update could very well completely remove the code from storage, making the job of hacking a much more involved process than just enabling a flag.
To be honest, I'm really surprised this hasn't happened in EU countries. If you'd asked me 10 years ago whether the EU would allow their entire road system to be used for a public beta test of half-baked semi-auto driving systems, I'd have said there is no way. Yet tesla just went ahead and pushed that feature out in a firmware update and noone really seems to have challenged them on it. I expect with this recent coverage, we'll see that.
IIRC think the Model X had a problem with the headrest already that resulted in full recall.