So they have a record of who has rented the car. So it could be one of 50 people in the last 3 months at a busy tourist location. If 50 cars were tampered with and remote controlled, will the police be able to track back through all of those people? Obviously, the bad guys would need to use a different person/identity each time they rent a car. OR, even easier, they could compromise some of the minimum wage car cleaners, and have them connect the devices on every other car they work on. Or their manager tells them they need to. Or their manager gets a phishing email from corporate HQ and a crate full of CAN dongles.
Next, you create a bunch of Arduino-based devices with Bluetooth adapters (cheap if you go through Chinese suppliers) that send out "Throttle to 100%" commands continuously. Sprinkle them throughout the planters and harmless decorations around parking lots. Stick them to the bottom of the numerous parking lot trams. On the side of the parking lot attendants hut. Have them all start broadcasting a week later.
You are not thinking at a big enough scale. What if 5% of the rental cars in Orlando Florida went haywire during a two day period? Would that cause chaos? Almost sounds like a terrorist attack. Yes, it could be fixed and prevented. Yes, you might not kill many people. But in the mean time, Team Badguys publically announces they did it, and have the means to do it in another city. THEN the FEAR makes people act stupid and give in, or pass laws that remove liberties. I seem to remember that happening around 14 years ago.