I brought the same issue up with Tesla about their firmware updates not being encrypted in transit, and their argument was the updates are cryptographically signed. Good enough I suppose.