On the car, not on the car at the victim's house.

Or the much more, frankly common, scenario is: a $15 plushie bought through Amazon wishlist, sold by PerpOwned LLC for $500, and delivered through Amazon warehouse. That's actually happening.

I don't know why anyone with a budget would choose to use an Airtag that notifies nearby iPhones and makes noise when you move it around. If Amazon lets you ship arbitrary items to people's private address, that sounds like a vulnerability with Amazon that is far more severe than simply shipping Airtags.