Android and iOS auto don't have access to the CAN bus that can control steering. They may have access to a physically separate CAN bus that controls the entertainment system and air conditioning. There are normally multiple buses in a car.
Is there a legal requirement that the CAN buses be air-gapped?
What has changed since https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...
Safety critical CAN bus messages should be signed.