content: The problem is that mailing someone a USB drive and saying "hey, plug this into your car" is a really shortsighted way to deliver updates.  Having people plug in USB drives should be something you strongly discourage, not rely on for update distribution.  What amuses me is that the vulnerability itself is exploited by hackers connecting to the vehicle over the internet and pushing custom firmware to the embedded system.  Yet Chrysler cannot itself push the security update through the same way.