Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.
That's true for most cars, but some, particularly the older cars, they weren't as concerned about security as they should have been. And so sometimes the radio can talk to things that it probably shouldn't be able to talk to.