Code review, trusted build environments and code signing could entirely prevent a single engineer from modifying the code running on the car.
Also, removing him from the the tech lead position would have helped prevent further incidents.
Then something else should. Imagine one guy, gone nuts, changing the code on millions of vehicles in one shot.