Needing physical access isn't a limitation here given the browser exploit, but even if it was it is still a security problem.
Cutting the brake lines and draining oil are very obvious methods of sabotage. Two minutes of investigation will make it clear that someone with malicious intent caused an accident.
Malicious code uploaded to a car is hard to detect. The inconveniences, property damage, injuries, deaths and the ability to frame the individual as the cause of those intended consequences are incredibly valuable.