Came here to echo the last part. Whether is some type of PIN code Oauth flow and/or QR code. There is an extra layer here you can put in the car software that c

Came here to echo the last part. Whether is some type of PIN code Oauth flow and/or QR code. There is an extra layer here you can put in the car software that can pair an app/car with a user. Smart home hardware providers commonly do this by MACID and possibly some type of PKI infrastructure. But even MACID doesn't stop someone from taking my 'unregistered' Leaf and registering it to their own account.