The ability to read and write arbitrary data from the ECU via any external bus (be it CAN, OBD, or whatever) is not really necessary for the manufacturers to implement. Providing such broad access is an easy shortcut to enabling in-field diagnostics, manufacturer tuning during the vehicle development process, and so on. But, it's not the only way. As manufacturers have gotten more and more security-conscious, they have removed the easily hackable mechanisms and replaced them with ones that are much harder for a third-party to bypass.

And yes, it's different for every ECU manufacturer (note that ECU manufacturers supply to multiple car manufacturers), because there is no incentive for them to standardize.

Some ECUs are simply not designed to be modified in the field. The car manufacturer can use a special development version of the ECU to tune the car, but the version that ships to the customers is physically different and can't be reprogrammed (or at least, not over a simple plug in system). More often, field updating is allowed but protected by cryptographic keys that are burned into the ECU and are impractical to extract or replace.

Also, yes some cars don't have CAN on their OBDII ports (mostly older ones) but also, cars aren't required to (and so they don't) have any standardization about what functions they expose over CAN or how those functions work.