Modern cars are built from dozens (or even hundreds) of interconnected computer systems, so there is certainly no reason they can't be susceptible to malware; you've already noted the recent example of hackers playing with a car while a reporter drives it.
Are there technical measures being taken to reduce the possibility? Some. Many of those systems are located on factory-baked ROMs that can't be reprogrammed, or that have very limited amounts of RAM, and therefore can't host a malware infection. But in general, the entire CAN bus architecture was designed a long time ago without security in mind, and the whole vehicle must be treated as a single trusted entity.
You noted physical access above, but that gap is widening as carmakers try to provide more integrated "features" for consumers. My car provides no less than twenty-three entry points that are available to both me and to potential attackers!
Safely locked inside the cabin there is a USB port and a CD/DVD drive that directly interfaces with the stereo; there is also the OBD-II jack. Unless the attacker is already inside my car, (such as a 'friend' with a thumb drive,) those are fairly safe.
Externally, there are three short-range RFID readers available, at the trunk, driver's door, and inside the cabin. There are four RF based short-range tire pressure sensors and receivers. There is a Bluetooth system interfacing with the stereo that has at least a ten meter range outside the vehicle. There is an RF based remote keyless entry transceiver that works from several dozen meters. And there is an independent RF based remote starter that works from 500 meters away. Finally, the stereo receives both terrestrial HD-Radio and satellite data streams for music, traffic, weather, news, and other types of data.
Any of those offer some kind of access into my car's electronic system, and I can only trust that the automaker has secured them all.
In addition to the data-based interfaces above, there are other entry points into the car that are connected to the bus. There is a rear-facing camera on the trunk, and a forward facing camera for a driver safety system. Is it possible they have a library that can read and parse barcodes for some legitimate reason? If so, can a barcode be used to inject an attack into them? There is also a radar transceiver, four ultrasonic range sensors, and the nav system has a GPS receiver. While I have no idea how an attacker might use any of those to gain some kind of access, and I would categorize them as a very low risk, that doesn't discount the fact that very clever people have attacked all kinds of systems before.
Finally, there is another non-obvious area of vulnerability -- the side mirrors. My mirrors have at least three electronic functions: remote X-Y movement, dimming courtesy lights, and a "blind spot occupied" warning light. To handle all this activity, I can only assume that the CAN bus is extended into the mirror housing, meaning a thief with a screwdriver is probably only a small piece of plastic away from interfacing with my electronics from outside my car. From there, he could tell the doors to unlock, clip in his own malicious device, or do whatever he wants.
This car is also three years old. Newer cars include WiFi access points and GSM transceivers, providing ever more accessible connectivity options for the would-be attacker. Features are definitely expanding faster than security.