My bet is either subcontracting the development to a lowest-bidder with no understanding of the concepts behind the code they're writing, or malicious compliance by an engineer that sees no reason to prevent people from installing custom firmware on their own car but still needed something that "looked" secure to get approved by management.