There are solutions to your proposed problem. You could require the car be taken into a shop for updates. This would make the update gradual (so the eggs are never all in one basket) and it would let mechanics ensure the update was applied correctly. You could also design the software to have a core that is never updated. It would monitor basic things like "Am I going too fast?" "Can I brake in time for any obstacles?" etc. Google uses this strategy IIRC.
