In contrast, there are tens to hundreds of thousands of popular car models sold every year. Eg 55k Ford Focus sold in the UK in 2019. https://www.statista.com/statistics/463148/ford-focus-annual...
Just a DOS attack would require every car to be taken by tow truck to the garage or visited by a tech to patch it, and the resulting reputational damage would be huge. I'm sure Ford/Toyota/etc would pay a ransom to avoid that.
In this new scenario, someone could have a remote rootkit loaded on their phone. Trigger it from across a parking lot or approaching the target and then simply walk up to the car and pull anything valuable out of it. They would look like the owner to most observers.
The key here is that one person can make a tool and sell it to many common criminals, and even if the auto manufacturer notices that they are doing this, there isn't an easy way to patch the issue. For something like a Tesla, it's difficult to imagine a software vulnerability that cannot be fixed with an OTA update, but for a manufacturer that doesn't have OTA update capabilities, I could definitely see cyber hacking tools being distributed and used in a similar way.
I guess if it was possible to remotely take over or disable the brakes on an entire fleet of self-driving cars then we could have problems. Likewise, if it was possible for school kids to "prank" their teacher by downloading some exploit software from the internet we could have problems. But in both cases you would hope security would at least be good enough that these types of events could not happen.
Remember someone with a bit of knowledge could easily tamper with your mechanical car today if they wanted to. Digital tech provides new attack vectors for someone seeking to do damage, but if designed correctly any new digital attack vector shouldn't present any greater risk than the existing mechanical attack vectors.