I would consider the "design flaw" to be not the lack of security (that's an implementation flaw), but the fact that the radio can even talk to the engine control and ABS computers at all!
That is a
marketing feature! How else can the car send periodic emails to the vehicle owner advising them that needed service intervals have been reached, miles driven, fuel consumption, download firmware updates to the various systems,
etc? Owners pay extra for the feature and monthly subscription costs for the service.
