I think the point is that if you're talking about finding malicious engine control activity, then talking about the number of lines of code for the entire car is irrelevant, because all that matters is the code for the engine control unit.