What’s to stop someone just hacking it and unlocking it?

I assume that they try to make that fairly difficult.

I mean, modern cars are Internet-connected, have cell radios. If the vendor can maintain access to the car and can provide the initial trusted hardware, they can make it pretty unpleasant to modify the thing.

You also don’t need a 100% solution. Just need to make the level of inconvenience high enough.