I’d say this rates as “midrange” in terms of car theft difficulty. Some cars (very new American and nearly all European cars) use some form of cryptography to authenticate that immobilizer messages came from a module which posses an immobilizer secret, so simple message injection won’t work like this.
Others (older cars, famous US market Kias) have no immobilizer at all and not even this level of sophistication is necessary.
I generally don't think this is true; most early immobilizer systems were DST80 or Hitag2 based and are broken both cryptographically and practically.
The reason enthusiasts re-flash ECUs is that it's easy, permanent, and works across a whole model line of cars, compared to reverse engineering immobilizer cryptography which is difficult, transient and requires re-work for each individual car.
Even modern systems are generally broken in private; you can find "emergency start" and "all keys lost" products for most newer cars, even European ones using AES. However, they're usually much more complex to use than the fake JBL speaker in the parent article's attack - most revolve around extracting key material from a control module using a software exploit. Common approaches include leveraging a leftover development artifact of some kind which allows sensitive key material to be exfiltrated from RAM, or locating a state-confusion or memory safety exploit against a CAN message handler.
But, at the end of the day, most modern cars are attacked using simple bent-pipe range-extension/relay attacks, so there's less investment in cryptographic attacks or compromising the actual system anyway.
Nobody is going to steal a 90s VW Jetta with Immo-2 when there are much easier to steal much more valuable cars everywhere. Neither shadetree mechanics, or street thugs that steal cars for drug money are spending a lot of time reading deeply into academic cryptography literature- it's only practically broken if you can either buy a $50 or less device, or follow instructions on a forum post to disable it.
https://www.researchgate.net/publication/346706377_Dismantli...
https://www.researchgate.net/publication/235916472_Gone_in_3...
https://blog.cryptographyengineering.com/2011/09/24/where-th...
Newer systems use AES, which is at least less cryptographically unsound than the LFSR-based systems like Hitag2.
Microchip present an interesting theoretical approach to AES-based immobilizer authentication here:
https://ww1.microchip.com/downloads/en/DeviceDoc/article_ope...
Note that these all focus on the key-authentication side. The inter-module communication ranges from completely insecure (like in the parent article - the key module says "OK, the key is auth'd!" and then just blasts an unauthenticated CAN message) to some variant of the key authentication strategy. For example, newer VW immobilizers use an AES-based nonce+MAC strategy similar to the theoretical Microchip one for both key communication _and_ module-to-module communication on the CAN bus.
I think you could also create a DoS attack in a parking lot by trashing the spectrum.
That’s an issue for 20 year old mechanical key + immobilizer chipped keys. It’s not that you lost the key, it’s just finally in need of replacement. Of course; you could shuck the key from the old one and place it in the new one.
Protip everyone with any mechanical keys: take a picture of your keys!!!!!
Compared to just a key it was a big step forward.
An initial problem has been amplification/relay attacks from wireless key systems.
Totally keyless entry is just the next iteration of attacks.