There was a limited time window in the early 2000s where many cars used only obfuscated access or a cryptographically insecure PIN code for key enrollment, but most modern cars use an attempt at cryptographic security with a centralized server.

If you want to see what's possible with modern cars, keywords like "VVDI" or "Abrites" and "All Keys Lost" will show you what aftermarket tools are capable of. Generally speaking, the capabilities in these tools are roughly equivalent to those the most sophisticated criminals have, as they're usually just stealing the techniques from one another in a big circle.

The level of security varies heavily from manufacturer to manufacturer.

For example, most modern VW cars require using an ECU exploit (which depending on the specific ECU, almost always requires physically removing the control unit and sometimes requires opening it) to extract encryption key data (CS/MAC) or physical extraction of the instrument cluster EEPROM.

However other manufacturers like Toyota seem to be more vulnerable to other exploits (I only research VW for the most part, so I frankly have no idea what's going on here), including a bizarre process which seems to require disassembling the steering column and unplugging a connector.