I appreciate thinking about abuse vectors ahead of time, but that particular one doesn't seem like a super hard thing to deal with? You can't just step into one at will, you need to actually order the car with the phone app and a valid credit card. Most homeless people don't, I would think, have credit cards.

And after doing it once, they'd be banned from ordering another car ever again. If the Waymo detects that the passenger has not left the car, I'd imagine it would first issue annoying notifications about how the trip is over, and eventually call the ops center who would order it to drive back to home base.

If someone manages to break into a vehicle without an active account with payment details on record, it can drive them right to the police (or shelter).

The doors are locked and you have to unlock them with the app before you can get in.

Automatically drive to a hub specialized for this or a police station?

Probably similar to Uber

They are monitored