One interesting problem "security" guys have is overcomplicating plots. Your average meth head is waaay too zonked out of his mind to memorize which VIN goes with which radio, or even which OEM radios need a code.
Another problem is via the VIN they know instantly that your car is a '98. Well my cheapo commuter car is also a '98, and its approximately worthless at this point. Anyone stealing my worn out, partially broken, approx 2002 model year aftermarket deck pretty much deserves the pain they're about to experience. At a flea market I might be able to give it away... That may very well be Honda's point of view. Now try that again with a new 2013 $2000 GPS DVD player deck and they might hassle you.
The article doesn't specify but does imply that, in this case, the dealer in question made more PIN requests than is normal. If so, Ford should have seen that and investigated.
I called up my nearest Honda dealership, gave them the VIN, and they gave me the radio code.
I like that they can do that. Maybe it makes more sense from a security standpoint if I would've had to call some centralized Honda location, but that doesn't really solve the problem, does it? I have the VIN -- so does anyone who looks through my windshield. I have the title number -- so does the dealership who originally sold the car. We'd have to enter a few concurrent bits of information to verify that I own it, that this car I'm calling about is mine, and I can identify both it and myself, and then the centralized Honda location would have to be able to verify all that on their end.
Or we can assume some modicum of trust at dealerships, and accept the fringe cases where criminals use information they wouldn't have access to in a perfect world.