In theory, they are just transmitting data, not code updates to the aircraft. So, the worst-case scenario would be that somebody would replace a chart with fake chart or something like that, which would be a nuisance but should not affect the safety of the flight.
As a matter of routine, any radio link should be considered an inherently insecure mode of communication, because it is open, unlike wire connections which can be physically isolated and secured against intercept.
Of course, if there is a bug or weakness in their system somewhere, it might be possible for a hacker to "pierce the veil" and somehow modify a live system. Whether that is possible or not depends entirely on the system architecture and implementation details of the software in question. Without knowing this (highly proprietary) information it is impossible to know whether such a weakness exists.
The official guidance on practices is contained in various FAA circulars, notably FAA advisory circular (AC) 20-153.
Here is a paper describing the general security situation: FAA Aircraft Systems Security.
Only the 787 is able to load actual flight system modules remotely, I believe, although as mentioned above many aircraft can wirelessly retrieve flight bag info. How Boeing verifies that a module is valid before loading I do not know, but in all likelihood they use a cryptographic certificate. If this is the case, then a hacker would either have to steal the cryptographic keys from Boeing, or find a bug in how they were using the certificate, in able to introduce a false module to the aircraft.