It is the lack of planning to prevent it that is years later branded as a feature to sell when company leadership looking to boost numbers or build political capitol start talking to law enforcement. Often after an acquisition or two.
I personally know a release engineer that was required to quietly send all new code changes to an NSA ftp server, presumably to make sure none of the bugs they rely on were fixed.
If something is in popular use and -can- collect data covertly, it will be co-opted to do so by someone for power or money without fail.
Destroying the means of surveillance, capturing targets, and reverse blackhatting is what will work.
... what would they have your acquaintance do if a bug they relied on were fixed? Push back on the change?
Could be they just decide to go take maximum risky advantage of the flaw before it is patched.
"Oh it wasn't our fault the software was wrote poorly. Not like we wrote laws around it or paid companies to share data with us."
What else do you believe that comes from the govt's mouth? Would you simply never believe they'd take advantage of us unless caught in some precise way, in some precise situation?
Government can start showing us it's loyal to us, or face attack of its own networks.
* There's an obvious, legitimate want for the vehicle's head unit to ingest this data, in order to display a UI (or provide a voice UI) which allows the user to call a contact by name or read a recently received text message. Is this a poor implementation concept which has mostly been supplanted by better implementations (Android Auto / CarPlay), sure, absolutely but it's not some thing that was added for the express purpose of "stealing" information. It's a long-standing set of features which use obvious, standardized Bluetooth technologies to fill an obvious, straightforward user need. Nothing weird there.
* There's no sign whatsoever that there was any collusion with law enforcement in the construction of these systems. They're just badly implemented, vulnerable software which is exploited by a forensics vendor (just like literally every other piece of hardware and software under the sun).