Even if you download an acars flightplan, you still check it and both verify it before you activate it
That is not the point, obviously the malicious software is not going to say "ready to install hack? yes-no". The point is that there IS a connection between ACARS and the FMGC therefore that connection can be potentially hacked. The fmgc can command pitch, roll and thrust. It can also has the performance databases that can also be potentially altered.
The Iranian centrifuges where hacked even though they had no physically connection to the outside world. It was done by introducing the malware in a routine software update of one of the components. In the same way that the many computers in modern aircraft are routinely updated.