It'll come to Ford (and literally ever other OEM), eventually. The biggest difference is that Ford is known for working with a number of legitimate aftermarket companies, where GM most certainly is not. GM's stuff has been cracked primarily because it's been implemented so consistently and logically for almost 40 years.
And yes, GM has asserted that you may think you own the vehicle but you do not own the software.
Believe it or not, automotive cybersecurity is a UN mandate (UNECE 155), and in the US you've got NIST (under the Department of Commerce), the NSA, and the EPA all pushing on this from various angles (not to mention ISO and SAE). Resistance is futile; buy older vehicles which cannot be programmed OTA, and secure the resources you may need to keep them running. If those resources involve running software, the Cobb incident last year may suggest keeping this on an airgapped machine.
This bullshit was among the reasons I decided late last year to pursue work outside the auto industry.