It's not that simple though, they do maintenance on cars as well so they'd need to be able to access those access codes as well. There probably should've been some oversight to make sure someone looking up thousands of VINs gets flagged somewhere, but it's reasonable to allow dealerships access to codes for cars they'd need to work on.