Quite a few people have already done this for the Ford Sync3 infotainment systems which are based on QNX6. You only need to connect a SD reader to the eMMC module on the daughterboard and mount the disk and install ssh. There are a few jigs around which you can buy to make this easier. The root password takes about 30 minutes with hashcat if you have an old model with broken signature checking so you can install a custom update package and install a ssh server that way (you do not need disk access for the digest, updates will get you there).

Depending on where you live, this might be illegal though.