I don't have the app (or car) so I can't verify for myself, but now it's hard to reconcile your statement with the twitter thread analysis I referenced above.

EDIT: Maybe it's a discrepancy about what a "confirmation" is? If the author of the twitter thread is correct, the "confirmation" is just a large button on the screen that doesn't require password re-entry, which is not much of a confirmation. He proposes that it's easy to accidentally spend the money if you go to the "upgrades" screen, then put the phone in your pocket without locking it.