The good news? It at least doesn't actually control anything; all it does is locate the vehicle with “pinpoint accuracy” and give it the ability to summon emergency services.
Sure - and that little connector plugged in the OBD port is completely passive, right?
Fact is that pretty much all engine ECUs listen to a certain CAN frame from the ESP (stability control) control unit. And this frame can be send from the OBD connector. This is how some chip tuning solutions work. They listen to the accelerator pedal signal and add some additional torque, to make the vehicle more "responsive".
This interface is vehicle manufacturer specific, so once you are in the system you could give for example all people driving a certain brand a hefty push for a few seconds. Really nasty, especially if you are driving a vehicle with automatic transmission.
There might be other bad things you can do over the vehicle CAN, but that one I know for sure.
Generally I find it negligent to connect the vehicle CAN to the internet, even with a firewall between there is no 100% guarantee that it will not be hacked. Systems that can potentially kill you if misused should always be air-gapped IMO.