I bought a used 2007 model with keyless drive in 2009. The car's menu system showed three keys assigned to the car, and it only came with two actual keyfobs.
The bigger problem with apps seems to be that you can fire up the app anywhere and do stuff with the car. An "extra" keyfob or a poor keyway design is only really a risk if you have physical access to the car.
Although I'd grant you that a weak keyway design with a limited number of unique keys is probably a real big car theft risk due to the fact that thieves can basically shop any large parking area and match a car.