It is not that simple, atleast in the automotive industry _today_. Atleast here in EU.

Every component is analyzed from a cyber security perspective. Many components needs tampering protection - while others need not. This includes replacing components with malicious ones.

It is not logical at all and a stupid regulation. But it is not as simple as you can do what you want if you have physical access.