No authentication. The only sort of authentication token is linearly predictable and printed in plain text on the outside of the car.
No rate limiting. They successfully used the linear nature to collect a list of valid VINs and validate them.
No apparent intrusion detection.
Bad response to security disclosure. They didn't fix the problem when it was reported, they still haven't addressed the researcher properly.
I'm not sure these are the right people to write life critical software (which admittedly, this vuln. does not appear to relate to life critical systems; just privacy and comfort).