That's pretty egregious. No password means you can read the VIN from outside a locked car and retrieve the driving history of the car and control at least the aircon. Wow.
Yeah, the 2 main issues with the VIN are as you say, the targeted vehicle in your presence, or enumerating all vehicles as they're sequential. Not great either way.