VINs are generally visible from outside the car (on the dashboard). That means until this was fixed you could walk up to a car, read its VIN, and remotely unlock & start it.