Manipulating actual flight controls is probably hard.

Manipulating sensors is probably comparably easy, and, if you can adjust the AOA sensors to make the plane think its in level flight while spoofing altitude data, you can probably manipulate the pilots (auto or not) into a CFIT.

It's happened on other flights where pilots became confused by conflicting information (AF447 and many others) so giving them consistently wrong data is going to cause a consistently bad output.

Anyway though I deeply agree that once you have physical access all bets are off. Sure, you can put a bug in which causes a complicated aircraft failure but you could also just put a time-delayed container of thermite or tannerite in the right place.

I'd be much more worried about a software update causing a major issue, either intentionally or even more likely and more worrying, accidentally ALA 737Max.

There was a somewhat recent event of someone proving he could control an airplane from the passenger compartment. They went into the logs and he made minor course adjustments. They seized his equipment but it didn’t say he spent any time in jail.

https://www.cnn.com/2015/05/17/us/fbi-hacker-flight-computer...

Pretty easy to make a device that overvolts a bunch of cables after takeoff.