Signing updates specifically would also still work with OTA delivery. Especially if the update can only be triggered from inside the car while simultaneously pressing some buttons. How the update is transferred should not matter for security.

OTA enables progress.

Assume there's a bug - safety critical bug. You cannot reasonably call people in house all at the same time, and continue to risk their lives as they "don't upgrade".

OTA updates also over time increases software quality, enables experimentation and slow/controlled roll out.

You are worried about short term problems over long term promise.

Most people wouldn't bother.

There's a fairly notable number of recalls that involve flashing new software to body control modules, ECMs, etc. Sometimes for dangerous problems around throttle control, etc. For example: https://repairpal.com/recall/14V583000

> In other words, like almost every ECU on the planet right now.

You're mistaken. Almost every ECU on the planet right now is flashable and they are indeed often updated as part of routine servicing, particularly on brand new models.

Not really. You'll have about 25% of vehicles that won't get updated, and you'll risk lives as recall's get remedied, over years.

You'll also not have any way to measure the impact of the update, chances are it is not perfect...

Data: https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/documents/13...