Automakers are notoriously bad at code [1][2][3], and consumers are bad at getting their car fixed if there is a recall [4]. I cannot see how connected vehicle security will go well.

[1] http://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_s... (look at slide 36)

[2] http://www.networkworld.com/article/2895535/microsoft-subnet...

[3] https://www.ece.cmu.edu/~ece649/lectures/20_sweng_crit_sys.p...

[4] http://www.nytimes.com/2014/05/09/business/recalled-used-car...