Man I really don't like Roblox anymore... I used to play it a lot with the kids in extended family. I was the "funcle" so to speak.
I tried to log in one day and found my password and email address has been changed. Clearly it got hacked, dunno how, since it was a very strong password manager password. Probably a data breach or something.
Anyway, I recover the account, and I'm horrified. Some weirdo has been impersonating me and speaking to the young members of our extended family. Nothing serious yet thank God, I caught it early. But really weird stuff like asking what clothes they're wearing. I contacted Roblox support but they didn't give a shit. I told the family, but I don't think they really understood what I was saying or why it's serious.
I deleted my account to remove that attack vector because that's just terrifying. Worse than those baby monitors security.
I'm not here to argue, but after a certain point it becomes a game of "hide the data stream". You'd be amazed at how clever you can be with this, and inspecting the logic of embedded firmware is difficult.
It often looks something like this (in algorithm or nowadays A.I. functionality):
This isn't theoretical, I've seen it before, software being sneaky like this. Resistant to observation because it can detect an artificial testing environment or network snooping tools. Difficult to prove misbehavior because the data is routed through multiple hops before being stored, and you can't easily inspect encrypted traffic. It might not even be the car manufacturer, it could be whoever is making the cameras. Basically, if it has a data connection and a recording feature, it's not secure.
What the other person is trying to convey is the common operating rule of most businesses nowadays. Breaking the law is worth it to them if the profits outweigh the consequences. For example if they only just increase profit by 4% per year, a low chance of a 4% fine after say 5 years is absolutely worth it. The only way to curb this is with completely ruinous fines, like "we will fine you 50% of each year this happened, dissolve your regional organisation, or ban you from doing business in the entire regulatory area (in this case the EU)" kind of consequences. Anything else can be optimised away.