I understand Apple's position here, especially with APIs that control vehicles. It's just a sad fact that Tesla hasn't provided a safe public API to control their cars.
This sentence scars the bejeebus out of me to think this could even be a thing. If you mean to control things like entertainment system, then maybe i'm okay with that. But I would not consider that controlling the car
1. They only allow for tokens that take a very long time to expire, it's something like 3 months.
2. Although a few of these apps allow you to get the token on your own and send it to them (thus not exposing your password), that's too technically demanding for most users and so most of the apps have you get a token by giving your email/password, thus you expose it to them.
For those that don't know, Tesla pays people for security vulnerabilities, welcomes hacker attempts, they disclose things after they fix them, there's a list of the things and people who found them at their website, etc. There is a separate computer system for the drive train that is not accessible through this system.
It might not be able to drive itself, but it can definitely control how fast and its direction, which would be super scary for some random dev to have any impact on.
Frankly, this is Apple arbitrarily choosing apps they don't like and findng a loophole to block it.