I believe devices on the CAN can typically see, and therefore spoof or simulate, packets from other devices. I'm not sure that physical access is really necessary because modern vehicles ship with networking capabilities (e.g. OnStar) that already have access to the CAN.
[1] http://opengarages.org/handbook/ebook/