I would be on board with this if the system was not touching the outside world, but it does every time you hook a smartphone to it or if you have an optional data network. Just like with our smartphones, there's nothing stopping a car company from pushing system-damaging updates when they want to steer us toward buying a new vehicle since that one is too outdated/no longer supported.
What you say can be true about a static isolated system, though. My employer has a Windows XP computer still running a machine in our factory. The PC was built built in 2006, connected to the Internet once upon deployment then disconnected thereafter. It has been running the software and machine more or less untouched since, receiving zero updates, performing it's duty as it was built to.
I'm not opposed to a player connected to a phone or other network, but that player doesn't need to be on the CAN bus, or any other car bus. Car speed for volume control, steering wheel buttons, lights, etc. can be communicated from the car to the player via dedicated wires (on/off, pwm, voltage ladder, etc.) like they did it in the early 2000s.
What you say can be true about a static isolated system, though. My employer has a Windows XP computer still running a machine in our factory. The PC was built built in 2006, connected to the Internet once upon deployment then disconnected thereafter. It has been running the software and machine more or less untouched since, receiving zero updates, performing it's duty as it was built to.