If this is a common thing, how does the party holding you liable typically show that the car was unlocked?

Usually a confession by the perp, and/or by the owner. It's not unusual at all for people not to know the details of the law like this and blurt out factoids, and for there to be harsh but difficult to enforce laws in the US.

I'd expect a "confession" by one who stole a car to be worth very little in a civil action by a third party against the owner of that car.

If the "confession" is from a known car thief, sure. If from a neighborhood kid with an otherwise clean record, then not so much.