The complexity is a symptom of it being a side-project, not evidence that it isn't. As a reminder, today's cars are still vulnerable to remote takeover via malformed songs on the radio because of shitty can-bus practices combined with buffer overflows in those side projects.
Safety-critical firmware is scrutinized fairly well (not because it's not a side project, but because of regulatory constraints combined with the small scope allowing the car manufacturers to treat it as a fungible good), but other software is not, even broken feedback loops interacting with that firmware.
Safety-critical firmware is scrutinized fairly well (not because it's not a side project, but because of regulatory constraints combined with the small scope allowing the car manufacturers to treat it as a fungible good), but other software is not, even broken feedback loops interacting with that firmware.