Notwithstanding bad actors, the federal Fair Credit Reporting Act (FCRA) requires[1], among other things:

1. Only business entities with a specific, legitimate purpose can request / access a credit report.

2. Consent must be provided depending on use case.

"Soft pulls" (e.g., pre-screened CC offers) can be done without your consent. (You can opt out of these.)

A dealership finance office or lease broker would absolutely run your credit, and typically there are explicit forms you sign authorizing such a check as part of that business transaction authorized by you. "At will" checks outside of such transactions would appear to be in violation of FCRA.

Conversely, credit agencies are required to provide you a list of all inquiries upon demand, so you can see if those parties you mention actually are running your credit without your permission.

[1] https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-r...