“this scenario is highly unlikely to occur in real-world conditions, limiting it to individual bad actors knowingly violating laws and product warranties.”

From reading this article, it looks like they just accessed the JTAG or SWDIO connector and simply wrote a new software on that thingy. If they were stupid enough to expose this kind of connector, they probably were dumb enough not even to secure it against reading, so one could probably just reverse engineer. I think I could easily do that if I had access to such a thing and would set my mind to it. It is not different from what I do every day for a job - programming such embedded devices.

I’ve been in places where people with this kind of knowledge meet by the thousands. I would not call this “highly unlikely”.