I'm baffled how we've come to accept such poor quality software in our products and key services. We seem to shrug off software issues that would deter purchase if they were material or mechanical.
1) physical access gives remote privileged access - this is a car, not a server! We don't lock cars in data centers, friends, family, mechanics, the car wash, valets or an entire custom base in this case may have access.
2) there is an idiosyncratic process that must be followed to ensure the vehicle is suitable for this use which is sufficiently obscure that it's often overlooked. The risks of which, are quite grave (remote tracking).
3) even if everything is done "correctly", it will limit the functionality to the product you've paid to rent.
There's a standard reset process that the rental company is simply not following here
Processes should/must be built with the users in mind. Users do unexpected, stupid things.
So, yeah, the car itself isn't doing anything wrong, but the whole "fleet use" system designed by BMW+fleet owners appears massively flawed. And that system includes all the software.
It would seem that the system works just fine, it's just completely being ignored by the rental company.
I could just as easily tape a cheap cell phone inside a hotel room to the wall and record the other guests with it. If the hotel cleaning staff doesn't clean the room and remove the device, how is that any different?