At least in the projects I’ve been involved with a lot of thoughts went into system design and security. The flash layer is really just a user interface. It renders nothing else than whatever UI code was developed. To interact with other components in the car (whether it’s adjusting temperature or playing back music) it makes IPC calls to services which are responsible for that. So even media playback and potential associated security issues won’t have anything to do with the UI. It’s no better or worse security wise than if you would do the UI in QT or any of the proprietary frameworks that had been used before. It just provided way better tooling and graphical capabilities.