There is a difference between being able to inspect study and modify software for a car and installing modified versions on your or someone else's car. We already have regulations covering radio emissions, this could be the same: modify all you want but you can't install a modified version unless you validate the modifications with a certification authority. Btw, the cyber resilience act in EU will cover these cases.