If someone's already inside the car, I expect them to be able to hotwire it eventually.

The trouble is when manufacturers extend the CAN bus out to the smart headlights or something, and it's the same bus that the body control sits on, so they can just send a door-unlock message...