The EU has explicit requirements in UNECE R155 and R156 related to cyber security and software update. A manufacturer will NEVER ever get a car homologated with root access, regardless if it is due to a vulnerability or by design. In fact, if some CVEs are found for your car that allows root access, you have to report this to the authorities and take immediate corrective action. It’s basically the same as if you found the car has defective brakes or airbags.