It sounds like this woman just wasn't aware of the control he had over the car until the parental control message popped up sometime in the 12 day span. Since the article doesn't mention anything after those dates, she was likely able to gain back control.

I certainly understand why people don't want connected cars but I can also understand the convenience factor. Yes, this amount of control over a car could potentially be used to put someone in danger (40kph on the highway isn't safe). But other than ensuring reasonable safeguards against speed controls on a highway, how would Tesla or any other manufacturer ensure convenient access to these remote features for the legitimate owner of the car? I guess one way would be to verify account information against an email or phone number that were used at purchase, only allow transfer of the remote control access by written authorization, and enable 2FA so only someone with access to the owner's email or phone can log in. I guess this still doesn't limit an abusive partner that simply just takes the victims phone or forces them to sign up using the abuser's information. And even so, is it Tesla's duty to ensure abusive partners don't abuse remote control? At best, they have a duty to ensure remote control cannot put the driver into a dangerous situation. Maybe they could have a local-only override code that allows an authenticated driver to temporarily cancel any remote control. Maybe all a remote user could do is reset the code but not be able to set a new one.