The test vehicles accept test/prod signed versions
Regular vehicles only accept prod signed versions
They are otherwise identical.
The test vehicles were sent test signed versions
The prod vehicles were sent the exact same update, signed with test.
This would not be uncommon since the test vehicles probably occasionally run test releases for debugging.
Further, the update is probably multiple signed pieces, and the only part accidentally signed with test was likely infotainment software.
Or something like this.
It's hard to believe they wouldn't test sending badly signed updates, so i have to imagine it's a particularly weird badly signed update.
In other words, i would not assume they are idiots.