See my response above. There is a firewall. I won't divulge too many details other than what anyone can learn by simply disassembling a SYNC module but will say all software for SYNC must be signed and approved by Ford. The SYNC module has two CPUs. The Freescale iMX handles all the graphics and I think it was a V850 from Renesance that handles all vehicle bus communication. Between these two CPUs there is a firewall which restricts what the graphics processor (iMX) can & can't get out on the CAN bus. The communication is essentially proxied; 3rd party software doesn't have a direct connection to any vehicle network.

And the concern is precisely as you said. They don't want 3rd party software setting off air bags as the inside joke always was.