When I used to write software like this. We typically had some sort of 'vpn', it was usually an isolated network 100% so you did not need that in the first place. For this I would have used an MDN on an isolated network. We would then write a solid bootstrap program with a watchdog on an ISR. Basically it would have an A/B area then we could flip between them as needed. If a particular version did not come up on a vehicle we could default it back to the old version. Usually some sort of flag that said 'yep this version is solid use it from now on'. Usually also the program itself could declare itself as bad usually catching itself in the crash and writing something out somewhere.

Not 100% as vehicle env is pretty harsh. +/-12V in 1-2 seconds on crank so you better have something to deal with that. -40f to +150f so you better have HW that can deal with that. Worry about how much flash wearing you have left. Oh and just general bouncing around, kicking hitting, coffee spills so your hardware better be decently hardened. Even then you still usually had those 10-20 vehicles that you just had to touch them. Usually it would be in the middle of Montana somewhere. If you were lucky it could be at a terminal. Oh and dont cost too much as your competitors probably have better and cheaper hardware.