Automatic over-the-air updates to cars do constitute a national security concern. A nation-state adversary who infiltrates the manufacturer can brick the cars, impeding the ability of essential employees to commute to work. And if the cars can be updated while on the road (either by design or by exploiting a vulnerability), it can be even worse.