I have an older cheapo JVC car stereo with bluetooth. I used an app to check for Blueborne vulnerability ("Blueborne Vulnerability Scanner," no longer available) which said the stereo was high risk. It is very unlikely to get any kind of software update to protect against Blueborne, due to its age. (I don't know if they even built in a way to update firmware.) It has no network connection except the bluetooth, but it does have permission to access my phone's contacts, phone and call history. The stereo has the option to run Pandora and iHeartRadio, but I have never set up the internet connection that would be necessary for those to work.
Clarification: This stereo is an aftermarket module that doesn't interact with the car in any way except receiving power, driving the speakers, and detecting the headlights on/off status through a dedicated line tat older cars have for that single purpose. I am not concerned about blueborne compromising my car - just my phone.
Question: Is it possible that someone could inject malware into my phone via an attack on the stereo? Is it realistic?