tldr: Cyber attack is 1000x easier than defense. There are enough Tesla cars on the road today that can be hacked into and turned into WMDs. Lots of ideas added in on how to bolster defense.
Many imagined terrorist threats are threats only in a vacuum. A rifle and a tall building resulted in 50+ deaths and 500+ wounded. Any technologically complex attack has to beat those numbers.
The only notable attack with an actual WMD was the sarin gas attack on the Tokyo subway. It killed about one fourth the number of people as a man with a rifle in Las Vegas. It took a secretive cult organization to implement. That's why nobody uses WMDs for terror attacks.
Trucks and rifles do enough damage without even having to acquire bomb-making skills. Autonomous vehicles that are programmed to avoid hitting pedestrians are likely to make it harder to use vehicles as a weapon, not more deadly.
You figure out how to hack it over the internet and load a program that uses its cameras to identify a pedestrian and drive straight towards it at full speed. You turn on this program at some busy time of day. There are times of days in which there are tens of thousands of late model Camry's on the road in the US, and this is the very first example I could think of when considering the problem raised in the article.
(That said, there are issues around actually reaching these machines, because a lot of them don't have routable IPs and may not load your attack web page. Similar issues may arise for cars, which sure would be nice as a mitigation.)
Even so, 0.5% of 1 million is about 5000 people. Not quite WMD territory, but also way out of typical "car bomb" territory... Maybe the mitigating factors would mean the actual fraction would be even less. But it would be nice if we didn't have to hope so.
Assume you have a fleet of self driving cars on the road deployed throughout the nation. A vulnerability is discovered that allows an attacker total control. They deploy that vulnerability, and cause every single car in the fleet to accelerate and aim for pedestrians.
So the next bit we have to ask is:
How many self driving cars would be on the road at the time this attack gets deployed.
Multiply this with:
How likely the driver/occupant will die in this event, how likely is this event going to kill or harm pedestrians, and how much structural damage would be done?
Play with those figures for a bit. Personally, what I'd consider reasonable guesses at these numbers results in some very large bodycounts.
You did not read the article
I knew what you meant only because I had read the article.
(This is just a cultural aside. I know there is a world outside of the United States.)