Elon Musk explains the camera inside Tesla's Model 3
theverge.com
theverge.com
Similarly, there should be a way to disable any kind of autonomous driving via hardware switch. in other words, it should be technically impossible to control the car via software once the switch is engaged.
I know, CAN bus devices are all controlled by the software, but these two subsystems must be isolated with something like an RS-232 link and a very conservative protocol between them.
Which means there will always be a way to hack into the system remotely and drive a high value target into oncoming traffic, for example.