as others are saying - you are correct - CAN is a shared bus so inherently insecure and physical access becomes a lot easier.