This is an attack vector more people need to know. Having a car secured by a login with no 2FA means your password had better be secure, decent, and unique. If you recycle it on 10 websites and one of them gets the right kind of breach you're in for a hard time.
Better yet, disable any...