The CAN+ and CAN- wires run around the car in, well, a bus and tapping into them anywhere is enough to inject CAN messages onto the bus.

It makes it less plug-n-play than the OBD2 connector, but thieves will still be able to do it.