It was tongue in cheek! I thought I’d made it pretty clear it was because users are idiots?

^^ all that

The ‘hack’ was to create a fake charger station, and along with it create a fake WiFi hotspot with the expected Tesla hotspot name. Then, create a captive portal page that visually resembled the real Tesla one, and use that to snarf username, password, and 2FA token. Then use those details within the 2FA-valid window to register another phone with the Tesla app.

Mitigations have nothing to do with the car itself, but instead in user education (not to ignore the security warnings on the spoofed captive portal page), add notifications of another phone app being registered, and ideally change the captive portal authentication method to use an app-generated key rather than regular login credentials – however this last one again is vulnerable to users ignoring security warnings and entering valid credentials anyway.