Sure, but my malicious "two weeks from now, suddenly turn left if the car is traveling faster than 80kph" firmware will give the same message.
I'm just not a fan of OTA updates for cars. Needing to have physical access raises the bar.
Remote updates just increases the attack surface, and makes RCE possible - and RCE on an entire fleet of 2 ton vehicles that can go 200kph is a nightmare scenario.
They could even use the gps in the car to target specific locations!
I believe a state actor or motivated team would have the resources to make this possible, and it would kill more than 9/11. The poor country's cruise missile!
I'd be OK with doing updates via usb or direct connection however.
Honestly, it's a little worrying to me that a car would need updates so often.