So from what I gathered, they weren't running any validation on the server aside from that the VIN existed and matched a customer's vehicle? No JWT token/cookie validating the logged in user or anything else?
curl 'https://hondalink.honda.com/api/VehicleFeatures/[VIN NUMBER]' -H 'hondaHeaderType.country_code: US' -H 'hondaHeaderType.language_code: en' -H 'Authorization: Basic [DIGEST]' -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Car-Type: HONDA'
They clearly intended to impelement authentication on their API endpoints, but didn't finish it, becuase the client is sending an Authorization header. But I don't know if their servers are even configured to check them. And they should certainly use JWT instead of digest.
The news is going to be saying "Security issue found, elite hackers elitely hacked into SiriusXM" when it should be saying "Sirius did not bother to implement any security at all for their remote management software"
P.S.: not that it matters, but - 401?
The difference is narrow, though, and really it's just semantics so both would be valid IMO: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403