He is revealing that other people can do this. Thus shaming the automakers to fix the issue.

Just sending a code blind is stupid. There should be a proper challenge and response system in place. Send door open request, response sign this unsigned random data, you sign and send back. So recording a key gets you nothing, since it would not be the correct response for the next door open request.