instead, they upload malicious code from a USB stick
Why bother - just grab the GPS details of $HOME.
Not new either - it is the traditional "treatment" cars get when they are broken in at amuzement parks, airport parking lots or anywhere else where you have a reason to believe that the occupants will be for at least a day.
By the time they get home their home is squeaky clean. And empty.
P.S. This is one of the reasons why I categorically refuse to this day to have an integrated car GPS. I should be able to chuck it in the bag when I park it for a long time somewhere.
Biting the hand that feeds IT
