Are we protecting the owner of the vehicle from fully accessing the vehicle that they own? On my 2011 car I can hook into the OBDB port under the dash and have full access to everything but the alarm system (requires its a separate programmer), and it's safe: drivetrain modifications require the engine to be powered off to apply.
Or is it theft we're protecting everyone from? The main (technological) cause of which lately has been the one-CANbus-to-rule-them-all idiocy that has taken over car makers, including putting the alarm and locking systems on the same unmoderated, unauthenticated CAN bus as everything else in the car. So a quick light pop and you're able to talk to every system in the car. We're back to solving a problem that didn't need to exist in the first place, if car makers had just thought this through before rolling it out to everything.
The correct solution here is to not further restrict the personal freedom of property owners but instead to stop designing and building systems that require stupid, and somehow always dystopian, solutions to even more stupid problems.
Proper security requires authentication and freedom-preserving authentication has to have owner-controlled credentials. That's the only way forward. Who cares where they run which bus. Encrypt/authenticate everything and give the owner a way to set their own key. Now we just need to figure out a way to make this a law...