I agree about the control portion. Even if the option is enabled by a hacker, OVMS doesn't contain the necessary code to control anything on the car. I think even if it tried to control the car, the most it could do is cause the car to reboot. Now if we drove Tesla Roadsters, however, they could unlock the car, run the battery down, prevent charging, and activate Valet Mode.
Not all hacks are weak passwords. Some are as simple as a bogus email phishing where even very strong passwords are useless if the recipient isn't careful (iCloud intrusion), others are more complex like Heartbleed. Brute force attacks, 0-day attacks, exploits, and such won't be stopped by a password. Most of these are weaknesses in the coding of the software itself.
Also, who's to say that 100% of the support crew for internet servers are totally honest? Hacks aren't always an outsider.
I'm just concerned on location data with OVMS. I know with Google that they track and store the locations of Google Account-connected devices, and users have the option to turn that off, but is that Off button a true off, or does it just make that data invisible to the user? Google makes their money from advertising, especially targeted ads, so they do quite a bit of profiling their users to "ensure you only see ads that are interesting to you." Google isn't the only one, but they're the only company so far that I've read through their privacy policy. It wouldn't surprise me if Apple and others have similar verbiage in their policies. GPS activates when Siri is triggered, and that location and voice data is sent to Apple.
