One reason we avoided the "connected cars" when we had to replace ours recently: Subaru's Starlink had a huge ineffectively secured backdoor that let anyone with a license plate and last name of a Subaru owner remotely unlock and start the car (and also get various personal information, including everywhere the car had been driven to in the past year). Here's a report from someone who found and reported the vulnerability (which has now been closed): https://samcurry.net/hacking-subaru