This is not even the first time, if we look at the car industry. Possibly different wireless protocol, but same idea: proximity without (tight-enough) time-of-flight check. How has Tesla not learned the lesson?
Why do you single out Tesla?
The title is wrong, this is a generic attack against BLE.
The lesson should have been to 1) pick or come up with an adequate protocol that includes tight time-of-flight checks or 2) not use proximity auth at all, if it is impossible to mitigate against relay attacks, in terms of physics and maths.
I'm saying Tesla's engineers should have known better, by 1) paying attention to news in the industry; and 2) properly understanding BLE before choosing it as the auth protocol.
Sometimes he's right. Often he is not.
Several dramatic "defects" of Tesla's could have been prevented - but why should Tesla care? "Bring it in for a fix!" they say. "It is not our money! Haha!" they say. And investors and buyers keep coming.