So how did examining the hardware allow them to unlock any car? Ideally, shouldn't each car have its own secret key, and no amount of examination of one car or its ignition key would reveal the secret key of another one?

The way I interpret this, the manufacturer has thrown a backdoor into the system, allowing access to anyone who knows the backdoor key - and the researchers have managed to extract the backdoor key.