There were 2220 cars stolen per day in 2020. While token bypass is a problem, I suspect that the biggest vulnerability is that nearly all cars lack MFA. Steal the token and you can steal the car.
Bait car programs are pretty well known in the US: https://en.wikipedia.org/wiki/Bait_Car_(TV_series)
And police in the recent problem areas have been doing this: https://www.youtube.com/watch?v=CAZh6D9sftw
https://slate.com/news-and-politics/2018/08/police-bait-truc...