It seems like a classic case of mistaking (or not taking seriously enough) the difference between authentication and authorization. He accessed the server throu

It seems like a classic case of mistaking (or not taking seriously enough) the difference between authentication and authorization. He accessed the server through the car's VPN, so there was an authenticated and authorized connection to the server. However, an authorized connection to the server is not authorization to make any arbitrary request on the server. It happens for the same reason that many games get MAX_INT high scores at launch.