since a lot (most?) of tesla's code is linux based, linux's heritage has always been to keep things separate so you can pick and choose how you want your system to be.
in fact, its actually MORE work to combine things and ship monolithic than to keep components in their own branches (which they are, anyway, at the source level).
its a very sane thing to do - to allow users to JUST update security and bugfixes. I cant imagine anyone who would seriously object to that, if it was offered. (however, I would still hold back on forced auto-updated, even secfixes. the user sometimes actually has a good reason for what they do and that power should not be taken away.
now, we have 2 more types of branches. UI stuff. that's entirely its own thing and could even be subdivided. we all know what it means to update one app on our phones. and we have full say over which ones get updated and which ones dont. hopefully still, everyone is with me, so far.
the last type of branch is new features, and yes, that does affect UI but 'form' and 'function' are modern concepts and so it should not be a problem to have a new function foo.c and its associated UI changes foo-ui.c if user wants that feature, they get those 2; if not, both of those stay off the car.
this is all controlled by how the build process works and the jenkins guys (build guys) can easily configure things to be how I just described.
its not really hard. it does take some manpower and forsight and planning, but hell, they've been around forever, in tech/dog years. its not asking too much. and there are no down-sides to the end users. NONE at all.