I literally worked on building the next generation of handheld OBD devices (m68000 based) that techs used to reflash Toyota ECUs in 1997. Automakers can and do update software after the car has been sold. Before that, techs would need to swap EEPROMS.

It’s getting better, but even now many traditional automakers strictly limit software updates to bug fixes only. And they'll probably only fix the bug if there's a legal or sales incentive to do so.

My own car is a 2013 BMW 125i. Its software stack received a handful of very simple quality-of-life improvements in 2014. The clearest example is the on-screen volume overlay. As delivered, my car’s volume knob provided absolutely no visual feedback.

If you ask nicely, BMW dealership can update it. But that's not enough. The way BMW "codes" your vehicle after a software update means that any features introduced after its date of manufacture are disabled. So even after I had the dealer install newer software (to fix a crashing bug with navigation) the volume overlay didn’t appear. What I ended up having to do was "recode" the ECU with a new delivery date. Literally all I did was change the delivery date in a pirated copy of BMW E-Sys, push the change to the car, and the overlay appeared like magic.