Researchers found an automaker had exposed credentials that could enable remote access to any of its vehicles with connected app functions enabled.