I think they mean using XOR with a repeated fixed tiny key _as_ the stream cipher, rather than just using XOR to mix the keystream and the plaintext.

These ECUs aren't using one time pads with key lengths the same size as the firmware. I doubt they're using one time pads at all, which would necessitate each version of firmware using a different key.