It is not that simple, atleast in the automotive industry _today_. Atleast here in EU.
Every component is analyzed from a cyber security perspective. Many components needs tampering protection - while others need not. This includes replacing components with malicious ones.
It is not logical at all and a stupid regulation. But it is not as simple as you can do what you want if you have physical access.
Well, the EU, being very much dictated by Germany, who have a large car industry, has a vested interest in making sure that if people want to have a better car they pay for a better one new rather than upgrade with an aftermarket chip.