You would need to be crazy to apply a voltage regulation hack to the CPU that they don't sell spare parts if something goes wrong. Risking bricking a $50000 car to unlock the $300 heated seats?
And while the root access is unpatchable, because the car is always connected to internet and always sharing too much telemetry to their servers, it would be trivial for them to add an additional server side check to see if some feature has been unlocked without paying.
would really spark some anger after people get stranded with disabled cars while camping for prolonged periods of time, or just parking underground while flying abroad.