This is a protocol flaw. The design assumes that proximity (signal) implies authorization, but the researcher proved this isn't always the case. The protocol should at least provide assurance that authorization really comes from the person who has the key fob. Old style physical keys do that, and so do key fobs with buttons.