There is probably a middle ground here. For example, lock it down like the parent comment suggested, but have a process to unlock it, requiring (for example) physical access and some vehicle specific file from the manufacturer requiring proof of ownership and a scary warning. (I believe some phone manufacturers had a similar process for unlocking bootloaders a while back.)

This would still allow enthusiasts and security researchers to "own" their vehicle and would keep malicious actors out (for the most part).