the relay is of the radio signal, there is no inspection or tampering of the relayed messages. basically, the extender tricks the car into thinking the fob is closer than it is.
In other words, there's identification, there's authentication, but authorization is replaced by "if in range, then authorized." Two out of three is still game over.