The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system".

[1]https://opengarages.org/handbook/ebook/ (chapter 9)