I noticed this notification when I last used Android Auto. I'm obviously not updating until Graphene pushes a sanctified version of AA in the Graphene App Store.
My car doesn't have a internet connection, so any threat they make from the internet doesn't seem credible to me.