The only totally secured system is one which is powered off and the cut up into pieces with an axe.
Some of they key goals of an airplane would be to keep it in the air and to know where you are located. Digital systems must obtain this information from sensors or from transmissions from some other system. Can you jam the airspace or interfere with beacons, radio, GPS, etc. EMP? so that the systems are fed inaccurate information? Can you take advantage of some trick of physics to trick the sensors into reading inaccurate input.
Maybe you compromise the system by installing unauthorized hardware or software before the plane takes off if the attacker gains physical access. Perhaps there is coding error of which an onboard spy can take advantage. Perhaps you just have a spy who is using his authorized commands to do something prohibited by protocol.
You can secure systems by ensuring there is proper encryption, authentication of source data, checks against replays - general stuff that is probably not there in commercial systems because of legacy systems and the need to upgrade the entire global infrastructure. There are probably additional physical protections to reduce EMI, etc. There are probably many things which could be improved security-wise, but it would be difficult to introduce these systemwide.
This high level explanation of PlaneSploit shows that there was a lack of encryption (authentication and integrity) controls in the systems attacked.