I'd implement two mitigation features ASAP: 1. Disable the ability to unlock the car if the phone has been stationary for a while. No more siphoning authentica

I'd implement two mitigation features ASAP: 1. Disable the ability to unlock the car if the phone has been stationary for a while. No more siphoning authentication from a phone in the night stand. 2a. Setup phone presence inside the car as a second authentication factor for starting the car. BMWs can detect if the key is inside or outside the car; I imagine the same positioning can be detected out of a bluetooth+wifi+nfc radio source. 2b. If phone positioning would require extra hardware, an alternative is using phone NFC as authentication (I think the keycard is NFC, so the hardware should be present)