1. According to this source, the infotainment system arbitrates flashing other ECUs.

2. Apparently people can ssh into the infotainment system.

1 + 2 => someone hacks into the infotainment system and flashes a safety-critical ECU. I guess/hope there's some protection in place to prevent that.