This is absolutely true, and the blog post itself definitely has a little of that "picking on Tesla" vibe. And I think it's unfair too.

But at the same time, this is pretty genuinely bad security architecture, and it really needs to be exposed and embarrass the company that did it. Tesla does some great stuff. This thing seems a little mailed-in, though.