They may not own their whole supply chain (but in the case of Toyota they have a significant investment in a lot of it, look up Denso) but the car manufacturers do specify all the components that go into their cars.
This is the way a lot of consumer electronics works, you may have an OEM who is good at core electronics, but not LED panels or software so they will buy these items in specifying requirements, including security so that they can produce say a TV.
From your description sounds like maybe the car industry has a lot of catching up to do.