What about reading (federally mandated, unencrypted) TPMS sensors
In many TPMS implementations, each tire has a sensor which broadcasts a short range signal to the ECU. Those signals include sensor identifiers (sent in the clear) so the ECU knows which tire is low.
Those signals can be picked up from 50m away. A set of 4 identifiers can (typically) be mapped to a specific car.