When someone finds a huge security hole (eg "blast this signal over high power bluetooth and you can make all Xiaomi cars within 1 mile immediately go to full throttle and crash!").
Or when a server the car uses gets shut down, and suddenly basic operations like opening the doors can't be done because it turns out the car's OS pings that server before letting any door open.
But don't you think there would be larger regulatory forces in play that would protect everyone from these types of issues? Xiaomi isn't just gonna refuse in a situation like this.