I'm hoping that it has redundancy involved - the same way there's a backup BIOS on some mobos so that you don't brick it if there's an error while flashing. Maybe the initial version of it permanently flashed on a ROM, that it will use if a later version is corrupted (which can be checked by CRC or something as such).
Considering that this is a remote thing, you especially have to consider the possibility that the vehicle can go out of range to receive additional parts of the update, etc, so there's a lot of ways that this could go wrong if they haven't thought through the possibilities. I'm going to go out on a limb and suggest that they've considered that.
The bigger concern I have is that they had better make sure that their software QC does not get lazy with this option available. A lot of times, that is the case - you figure if you mess up, you can always send a new patch with minimal error, but within a critical system such as a car, if you mess up badly enough and don't catch it before it ships, you can kill someone. Let's hope someone up top at corporate isn't thinking that this means they can reduce costs from a QC standpoint.