Clarification: this is a vulnerability in the Internet of Things component attached to the car. The car itself fine, and the vulnerability is only in devices with the silly and expensive IoT upgrade package.
Well to an extent, if you've enabled the service any third party can remotely enable, disable or reconfigure AC and heating (which is pretty problematic for an EV), and the service also provides limited travel information (no GPS location, but travel times and distances)