Even without vulnerabilities like that, something like https://comma.ai/openpilot could very likely be used in the same way ArduPilot was used in the recent Ukrainian drone attacks.