I don't have a BMW, so I may be wrong, but from the comments it sounds as though:

1) physical access gives remote privileged access - this is a car, not a server! We don't lock cars in data centers, friends, family, mechanics, the car wash, valets or an entire custom base in this case may have access.

2) there is an idiosyncratic process that must be followed to ensure the vehicle is suitable for this use which is sufficiently obscure that it's often overlooked. The risks of which, are quite grave (remote tracking).

3) even if everything is done "correctly", it will limit the functionality to the product you've paid to rent.

If you were the owner of such a car, how exactly would you expect to link your phone to the car using the first party app if not for physical access?

There's a standard reset process that the rental company is simply not following here