I worked for a modern car rental company where you just need to download an app to drive a car. The tech was super interesting, there are vendors that sell a box with both gsm and ble interfaces and the cars are fitted with these.

You can send messages through ble or their cloud api / gsm. The app needed to first acquire a token to successfully establish a ble connection.

I'm not saying you can't buffer overflow through ble messages but at least the authentication was solid.