I hotwired an old 1970s “boat of car” in 1992 (with permission) but i had no idea how you’d steal a car newer than that. Car thefts fell out of fashion and the new fear became “carjackings” where somebody steals you car at gunpoint when you’re driving it.
By the 2010s people had forgotten that car theft was a problem and I started hearing stories about cars being stolen with insecure keyless entry systems, now sometimes they smash a headlight and hack into the CAN bus. It’s a fairly predictable problem in law enforcement and crime management that people have a finite list of priorities to attend to and if they decide to do something about car thefts or excessive false alarms or racism or whatever we get some improvements but once there is improvement people get worried about something else then the old problems come back.
I'm familiar with a couple designs - and on my vehicle I found it trivial to temporarily override (with the wiring diagram in the service manual).
My vehicles are on the older end of having immobilizers, but on them automakers certainly didn't integrate it tightly with other systems. It is controlled by one of the main ECUs - but the lockout method is subpar.
Better integration of the immobilizer goes along with the development of new engine management systems - so there may be more integration on vehicles with the newest engine designs (but not necessarily if the engine descended from a previous design and they kept the engine management system mostly intact....).
Some immobilizers disable starting, some disable fuel pump, some disable ignition, and some disable injectors. The how these are electrically disabled also matters a lot.
It's still trivial to override the first two methods, and sometimes the second two, but at least the last two have the potential to require more than a wire to disable if they are better integrated with the ECU.
That could even be quick, depending on the make and model of the car.
The next step is to make all components work only if they can verify the ECU is the right one via the cryptographic solution du jour.
But this also complicates replacing wear components like coil packs, which now have to be tied to a specific vehicle, and can be defeated with enough part swaps anyways.
Physical security is hard.
There are some sophisticated gangs that are stealing the cars and chopping them for parts or shipping them to South Africa.
Then there are people who steal cars for fun.
The later are easy to deter with technical measures, the former much harder.
Personally I think there ought to be a "tough love" conversation with certain German carmakers about how they sell parts with the possible endpoint of them being kicked out. German cars are overpriced and unreliable and they seem now to be planning gas cars for centuries after the rest of the world moves on. If European car brands were excluded from international trade I think that would make the world better and not worse.
However, there are some brands of car where it's possible to gain access to the CAN bus, and inject "start the car" messages, so then it's just a case of a standard ignition lock theft (which is easily done in old school sawn off bit of scaffold pole style).
Some cars headlight wiring connects to the same CAN bus as the immobiliser, making the theft easy from outside the car. Don't have the link handy, but there was an article on here a few weeks ago about it.
Between dealing with that and the immobilizer, stealing a car was a big hassle and car thefts were rare.
Absolute geniuses decided to make keys not required and instead just broadcast an unencrypted password 24/7