Keyless entry replaced a deliberate action with a passive check, and that change had a security consequence nobody needed to consider when keys were turned by hand.
The system decides based on proximity
A passive entry vehicle continuously looks for its key. When a door handle is touched, it transmits a low-power challenge and waits for the correct response.
Because the challenge is deliberately weak, a response can only arrive if the key is genuinely close by, which is the security assumption the whole design rests on.
The cryptography protecting the exchange is generally strong. The vulnerability is not in the code but in the assumption that a nearby response means a nearby key.
Extending the range defeats the assumption
The known attack involves capturing the vehicle's challenge and carrying it to where the key actually is, then carrying the response back.
The key answers correctly because it received a genuine challenge, and the vehicle accepts the response because it is genuine. Neither device has been fooled cryptographically.
What has been defeated is the distance assumption, which is why the attack works against systems whose encryption has never been broken.
Manufacturers responded by measuring distance directly
Newer systems measure how long the exchange takes, since a relayed signal necessarily travels further and therefore takes measurably longer.
Ultra-wideband radio makes this practical, providing timing precise enough to establish that a key is within a small distance rather than merely reachable.
Motion-sensing keys that stop transmitting when left still for a period address the same problem from the other end, by removing the key from the conversation.
Owners can achieve something comparable with a shielded pouch, which blocks the radio exchange while the key is stored. The measure works precisely because the attack depends on the key being reachable, and it costs nothing beyond remembering to use it.
Vehicle design amplified the consequences
Once a vehicle can be entered, systems that permit starting without a physical key mean entry and driving away are closely linked.
Many vehicles also disable audible alarms once a valid key response is received, so the theft is quiet as well as quick.
This is why the response has included tracking systems, immobiliser improvements and, in some markets, insurers pricing keyless vehicles differently.
Physical measures returned as a result
Mechanical steering locks and wheel clamps have re-emerged on vehicles fitted with sophisticated electronic security, which is a striking reversal.
They work because they address a different layer of the problem, requiring time and noise regardless of what the electronics have been persuaded to accept.
The wider point is that removing a physical action from a security system removes the human confirmation that used to accompany it, and something has to replace that.