Very few ECUs have CCP/XCP writing wide open. A lot of magic is in the area of defeating the cryptographic signature check on the device (hash of flashed contents).
As others have mentioned most USA manufacturers are moving to encrypted CAN buses now though.