It can be useful if you lost the keys for $REASON while hiking or doing any activity and you can phone somebody else who has access to the API and ask them to unlock and remote start the car. It doesn't happen that often, but it happens, and in the big scheme of things it's more likely to happen [1] that somebody stealing it via a vulnerability in the car maker web services.

Or at least as a car owner, this is my risk assessment exercise output.

[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.