Modern cars expose the engine/body control CAN bus through the fucking headlights. You don't need to be in the car and it doesn't need to be on for you to have the same or more access than the OBDII port.
It doesn't matter what the country of origin is, someone is gonna find a way to break OTA updates, gain access via exposed wireless networks or just pop off a CAN bus controlled light and plug in. How long before someone pushes a malicious update that causes the ABS to disable or degrade braking to near 0%, or just throw the electronic power steering full left whenever the speed exceeds 101km/h?