Are you worried that your iPhone or Tesla will be hijacked the same way? You already know this happened before with the knowledge of the companies involved (secret subpoenas or national security letters) or without it (beacon implants).
There is hard evidence of the vulnerability, which logically follows from any OTA update capability, but there may be no hard evidence of exploitation yet.
Think of it this way: if your software has a RCE, you fix or mitigate it regardless if it's actively being exploited or not.
> Are you worried that your iPhone or Tesla will be hijacked the same way?
That's a very valid concern for some people.
Ultimately, software security boils down to "who do you trust?". Say what you will about the US, but your goals and values are very likely less incompatible with those of the US than with those of authoritarian China [1] [2].
[1] https://www.nytimes.com/2013/08/20/world/asia/chinas-new-lea...
Do you think it's more about your values or somebody's ego and interests?
But if the US actually took that threat seriously, half of the Valley would be out of a job tomorrow.
Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update.
[0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing
This is what's implied.