If the car manufacturer got control of an app on the phone it is trivial to exfiltrate data via Bluetooth.