Wow I sure hope that's a dumbed-down explanation for the press, because I don't want my radio and (say) my ABS or traction control to have enough of a connection to each other to even establish any kind of "firewall" between them.
And the concern is precisely as you said. They don't want 3rd party software setting off air bags as the inside joke always was.
Don't worry. The airbag supplier is looking out for themselves and doesn't want anything screwing up their modules function. The engine controller and brake system are certainly connected via CAN but you're not going to reflash anything without using the correct protocol and having the right key for each controller. You also don't need to worry about buffer overflows or such because CAN is strictly limited to 8 byte (or less) packets and a 29bit message ID. Most messages define particular signals to be in those bytes and critical signals have checks run on them. And on and on...
No, it's not perfect but I don't think you need to worry.
You don't need to worry if, and only if, you assume that the standards are designed correctly and all vendors code to all the standards correctly.
As Quviq found, you should not assume either of those things.