They can already do that, considering that most (normal) cars have anti-theft systems (aka remote kill switches). The only thing missing is the API access, like you mentioned.