If the car companies can't write software that would withstand hacking skills roughly equivalent to a curious teenager, what hope do they have against criminal organisations or nation states? I don't really want to think about it...
edit: I will inform HN if my climate control mysteriously turns on today :)
But here, we have a system that's deliberately designed to use, as its only public-facing authentication token, a string of characters literally printed on the car. No amount of inattention or oversight could possibly lead a person to confuse that for secret data, unless they were somehow totally unfamiliar with cars.
I have a hard time figuring out how something like this could even ship. To me, this is a lot worse than responding badly when told there is a vulnerability. After all, if you think it's OK to use something any passing stranger can read as a secret key, some random internet dude telling you it's insecure probably won't suddenly make you realize you've got it all wrong.