I also find the outlook a bit optimistic admittedly, but there are definitely plenty of better targets than cars for a sophisticated actor. Car software is very different from model to model, and there's a large variety of models on the road - even if you can cause all cars of model X in an area to accelerate to dangerous speeds (something far beyond the capability of current exploits), that will only affect a small proportion of all cars in the area. It will undoubtedly cause chaos, but nothing on the scale you can get by attacking some weaker systems.
Even a coordinated attack against traffic lights is easier to pull off and has no less potential damage.
As to versions, you may be familiar with Cellebrite? Their stock in trade is having a huge database of exploits for every popular phone. And cars frequently have common software and computing components. It's just a matter of time before script kiddies can pop an unpatched car -- as soon as their is an external wifi / 3g connection. At the moment most only have Bluetooth to the stereo.
I'm curious as to what weaker systems they were thinking about. Obviously the OT at various plants, but that can be air gapped. Most traffic light systems have in built low level safeguards to prevent conflicting states, and the high level system is centrally managed and patched. Attacking requires a multi-stage attack, maintaining access requires continual maintenance, so it just doesn't have the impact an unpatchable vuln in embedded devices does.
And that's back to the original point, if you are looking for such small scale problems, make a spike strip and deploy it on the highway. Same scale of destruction as taking one car over, orders of magnitude less skill and money required.
Cars have standard components, but even for cars that don't take digital security seriously (Tesla has that reputation), no driving functions should be on the same network as the external 3G/4G. Yeah you have the infotainment or door opener there, but any ECU running an ASIL-qualified function should be on a separate network, and treat anything connected to the external world as untrusted. That was definitely one of the core architecture assumptions in all car software I've seen. The infotainment system is considered to be compromised and possibly sending malicious data. All the important communication happens on a different network, where internal signing and authentication mechanisms are also used.
And at that level, the internals are too different for the same exploit to work everywhere. What you need to send on the network to make the car brake, or what data format represents the gearbox position, those are different.
A spike strip, you have to be in the area. A remote attack, you don't have to particularly care about any specific area enough to physically travel to it.. someone can cause chaos simply because they are bored.
And immediately after, they can go do something else.
Tech vulnerabilities aren't yet accessible enough to these types of people, but soon enough they will be and it is not like security is in a temporary poor state. A lot of these systems will remain unchanged for a long time because they are part of an already working business model
A centralised and timed attack against a tech stack that has significant dominance in the market in the future has one of the biggest potential ceilings out there. Cars are effectively kinetic weapons and if you could say, get 30% of vehicles to turn into on coming traffic on a Friday afternoon the outcome could be seriously ugly.