For this to be even remotely possible, the infotainment unit would have to have direct access to the CAN bus which is certainly not the case (at least I hope). Most probably, the car expose some feature through an API to the infotainment unit but that would not include any direct control on the car driving operations.

I would expect the radio to have access to a CAN bus. The same diagnostics tool that uses can to read your engine should also be able to read the radio, and the infotainment should have all the ability to display all DTCs and what they mean.

I would expect all controllers with safety critical functions are carefully firewalled so that you cannot do bad things via CAN.

It depends on what you mean by critical I guess. comma.ai and OpenPilot uses CAN to perform steering, acceleration and braking (I think).

https://github.com/commaai/openpilot/blob/master/selfdrive/c...

There are usually several can buses in the car. Entertainment (also includes power window buttons, etc I guess) and power-train with a gateway in between those if some of the PT-CAN messages are needed on the entertainment side.