IIRC they use PKI with your keypair bound to your account. So if you own a Tesla and hack it you can pretend another car is that Tesla. You can also hack someone else's car but then they'd have to pay for your charging and that'd probably be stealing or something like that.