[taneq]

Priority doubles as ID in most CAN systems, so changing the priority means you're no longer sending the message to the same endpoint. As you say, though, CAN isn't secure against someone with physical access to the bus.

IMO "the problem" isn't the CAN priority system, it's that a remotely programmable device (the CAN gateway) was connected to both the control network and the internet (via the entertainment center). For something so security critical, it should have been kept as dumb as a box of rocks, and certainly never made network-updatable.