> the only real fear here is a state-level attack.

This is blatantly false. In the real world there was a major recall after security researchers (not state actors) demonstrated that they could remotely interfere with safety critical systems. OTA updates without user involvement are a massive security vulnerability. So are internet connected safety critical systems. Neither should be legally permissible IMO.

> I just don't think getting every Honda to crash at 4pm is a vulnerable enough attack vector to make this hypothetical worthy of much thought.

Setting aside assassinations do you just have no imagination? There have been all sorts of crazy disgruntled worker sabotage stories over the years. Mass shooters exist. Political and religious terrorists exist.

For a specific mass scale state level hypothetical imagine that the US enters a hot war with a peer adversary for whatever reason. The next day during the morning commute the entire interstate system grids to a halt, the hospitals are completely overwhelmed, and the entire supply chain collapses for a week or so while we pick up the pieces. With a bit of (un)luck it might happen to catch an oil tanker in the crossfire while it was in a tunnel thereby scoring infrastructure damage that would take years to fix.