>> Wow I sure hope that's a dumbed-down explanation for the press, because I don't want my radio and (say) my ABS or traction control to have enough of a connection to each other to even establish any kind of "firewall" between them.

Don't worry. The airbag supplier is looking out for themselves and doesn't want anything screwing up their modules function. The engine controller and brake system are certainly connected via CAN but you're not going to reflash anything without using the correct protocol and having the right key for each controller. You also don't need to worry about buffer overflows or such because CAN is strictly limited to 8 byte (or less) packets and a 29bit message ID. Most messages define particular signals to be in those bytes and critical signals have checks run on them. And on and on...

No, it's not perfect but I don't think you need to worry.