Logically thinking, updating of license and passport info requires security clearance. Some form of authentication is needed. I believe if the designer of MyKad do it correctly, it should be a cryptographic challenge-response authentication, or perhaps the updated data have to be digitally signed. On the other hand, if a fixed key is used to enable updating, then the fixed key will be easily leaked out. My guess is that challenge-response protocol is used and a Secure Access Module (which is installed to card reader) can prove to MyKad that it is authority now talking to MyKad. I currently do not have any info on the command used for updating. I believe that knowing the command is not a security threat because MyKad will give a different challenge each time, without the SAM, we don't know the correct response to prove to MyKad for the write access.

The card may or may not implement procedures to update JPN info. In practice, JPN info will never be updated. If you change home address, the whole card needs to be changed.