RS-485 / CAN signal levels
CAN can go up to 1 Mbit/s on busses up to a few 10s of meters.  The passive state doesn't really slow down the signalling.  A total of 60 &Omega; is pulling the lines together, which will make them do so quite fast.  I have looked at bits on a CAN bus with a scope, and the edges have been nice and solid in both directions.  Think of the fact that the passive state is still driving the bus together as if it were shorted, but the drive impedance is at the characteristic impedance of the cable.  A deliberate driver would have the same impedance, so there is really no difference.

What limits the length of a CAN bus in practise is that the signal must do a round trip between the two most distant nodes in a fraction of a bit time.  This is necessary for the collision detection mechanism to work.

RS-485 and CAN are really in two different leagues.  RS-485 throws you a electrical spec for a multi-drop bus, and that's it.  CAN defines whole messages with IDs and data bytes, a checksum, control information, collision detection, some error detection and error handling, and full use of the bandwidth under heavy loading, all on a true peer to peer network.  In addition, this plus automatic sending retry is built into hardware on a number of low cost microcontrollers.

You could in theory implement something like this using RS-485 as the underlying bus, but getting all the protocol details right for reliable operation in all the corner cases is nowhere near as easy as some people seem to think.