Probably because they use a bus that's harder to on-the-fly rewrite or because they sign commands.

comma openpilot do its thing by faking stock self driving unit talking to actuators over the in-vehicle network; a modern car is like a bunch of Pi on a LAN hosting microservices, but on a car specific network standard, usually the one called CAN bus, instead of the 802.3 we're familiar with. The manufacturer stock units is usually a camera unit integrated CPU sitting behind a hump behind the rearview mirror. comma devices tap into the cable going in there, sending out fake commands to other computers handling cruise control, brake, steering, blinker... etc.

This can break two ways: some communication standards like FlexRay are harder to tamper and fake, or some newer cars have tightened security clearly in response to comma doing its thing too well, many following the new EU cybersecurity standards which require commands to be signed and/or each of those Pi-like modules to be crypto paired against each others.

I think Stellantis car always had the first of those two issues of having something difficult that are not strictly anti-hacker hostile architecture. But could be both or I could be wrong altogether. The comma devteam seem to like 2015-2019ish hybrids from such brands as Honda, Subaru, Hyundai and Toyota for the presence of the remote control features in the actuator modules && lack of security getting in the way.