Forgot to say......anyone can easily find a VIN just by entering your license plate number into an app. Give me your license plate info and I'll give you your VIN.
EDIT: I pulled this image off of Google. Using the plate number, I know this is a 2018 Model 3, VIN 5YJ3E1EA7F058552
Yes exactly. Assuming OP's story is true, and we have no reason to assume otherwise, it would seem that anyone with the VIN of a Tesla could initiate a fraudulent change of ownership with Tesla and take control of the car via the app.
You can also look up vehicle history, where it's been registered, where it's been repaired, etc. This is why when I post pics of my car online, I generally obscure the license plate and VIN.
My car (pictured in my avatar image) is currently listed for sale on Craigslist. I had an "interested" person who seemed truly interested in the car not just my phone number (which is most common with CL scammers) but something was off. He was asking questions about it that didn't make sense that made it sound like he was trying to come across like he knew about Teslas (when in fact it revealed the opposite). He asked several questions, but kept asking for a picture of the front of the car. I intentionally did not post a picture that showed the lic. plate, but virtually everything else of interest was visible. Finally I gave in and sent a picture of the front, but taped a piece of paper over the lic.plate. I also scrubbed the image of my gps location metadata. Never heard from the guy again.