York Regional Police (via MacRumors):

Since September 2021, officers have investigated five incidents where suspects have placed small tracking devices on high-end vehicles so they can later locate and steal them. Brand name ‘air tags’ are placed in out-of-sight areas of the target vehicles when they are parked in public places like malls or parking lots. Thieves then track the targeted vehicles to the victim’s residence, where they are stolen from the driveway.

And this, on how they steal the car, without keys:

Thieves typically use tools like screwdrivers to enter the vehicles through the driver or passenger door, while ensuring not to set off alarms. Once inside, an electronic device, typically used by mechanics to reprogram the factory setting, is connected to the onboard diagnostics port below the dashboard and programs the vehicle to accept a key the thieves have brought with them. Once the new key is programmed, the vehicle will start and the thieves drive it away.

Of all the suggestions on protecting your vehicle, this seems the best suggestion:

Install a lock on the data port. This simple device can be purchased online and blocks access to the computer port where the thieves gain access to reprogram the vehicle’s keys.

Here’s a video that talks about the OBD port (the data port called out above) and one device in particular you can use to lock the port.

Personally, I think an OBD lock is far more convenient than a steering wheel lock, since you only need to remove the lock when you need to access the port (for service, say).

From John Gruber’s take on this article:

I’m interested in knowing how the police figured out that AirTags were used in this way. Let’s say a thief hides an AirTag on your car while it’s in a public parking lot. Then you park the car in your home’s driveway. The thief comes in the middle of the night and steals your car. You call the police and they come to your home to investigate. How would they know an AirTag had ever been involved?

Solid question, read the Daring Fireball post for John’s best guess. If Apple could go back in time, I wonder if they’d still release AirTags, knowing what they know now.