As unlikely as Israeli state sanctioned spyware company Pegasus covertly infiltrating hundreds if not thousands of mobile phones of politicians, high ranking officials and all sorts of other people across the globe? Pegasus was sold to a wide range of governments and went undetected for quite some time.
It remains a fact that anything with a network connection, especially something connected to the internet can be exploited regardless of the cybersecurity guards put in place - for high value targets it is state level actors that do this, law enforcement and intelligence agencies will always have a way to gather intelligence on their targets regardless of security, EVs are just another tool to be exploited.
At pleb level it is more about tracking usage, location and gathering data for advertising and various other metrics, unless you are an activist/criminal/politician/someone to be manipulated of some kind it is unlikely that ordinary plebs will be targeted by the state.
But we should be concerned about the capabilities that big tech and governments have to monitor and control us.
https://en.wikipedia.org/wiki/Pegasus_(spyware)