This is true, although in a previous job I was surprised to be working on systems that could receive steering commands with unencrypted CAN messages.

As others have mentioned most USA manufacturers are moving to encrypted CAN buses now though.