and they'll update it when they service the car. how is that software any safer than the OTA?
its not.
There have long been techniques for writing software as formal proofs of correctness. As far as I can tell, they haven't been popular with mainstream programmers because they are simply too different.
It's easier to test one change in isolation than to try to figure out which of these 20/200/2000 commits broke things.