An app can embark all modern authentication and encryption systems. You can easily secure the exchange, like we do for web today.

I imagine that the car companies either had strong hardware constraints in the key fob, or no security competency, or no interest in investing there.