Consider how much wire would be required to route every button directly. There would be tens of pounds of extra metal, plus impossible bundles of hundreds of wires to route around the car.

CAN is great for its purpose, but handling untrusted actors is not part of that purpose.

What should happen is a non-CAN hardware gateway that only passes valid commands to CAN buses.