One possibility is that it’s maybe useful for the fleet operator to be able to remotely update firmware and the attacker used that.

The other, more likely, answer is that there’s a diagnostic mode that allows raw control of the system and no one bothered to require physical presence to enable service mode.

With remote firmware update capability, at attacker could easily brick the entire fleet. With just service access it could be possible but would be more complex.