Nobody here has claimed to know exactly what exploit the thieves are using. But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. And that point is what seemed, to me, to be missing from TFA.

If TFA had given some more context, and said "exploits which would allow this type of access were shown at a recent hacker conference, and some cars have known exploitable vulnerabilities... but we don't know if this crop of thieves are using that or a newer, unpublished exploit" then it would, IMO, have been a better article. Instead, it leaves people with the idea that this whole concept (hacking cars) is something brand new, unknown, and unexpected. And it's not.