Well, it is usually on a different (layer 2) network, but usually there is a gateway routing messages between the two. Why? Because the CD player is embedded in the entertainment system, and that system displays information from the engine (e.g. current mileage), or you may be able to configure your engine via the entertainment system (like switching your engine and gearbox to "sport" mode). However, the gateway does not blindy route any message to any network, there is usually a fixed configuration which message should be routed to which network.
Nevertheless, most development in the field is centered around safety, and not focused at security, so I'm not that surprised that vehicular networks are hackable.