And there's the problem that if the PIN or worse a biometric version of this becomes remotely well known you've now created an incentive for a car thief to kidnap people even if they only want the car.

Or anything else you can't easily transfer. I can't help but point at passkeys in particular (or 2FA in general).

A variant of this is the well-known scene from a previous century's movie involving extracting an eye to bypass retinal scanner.

Many cars already have internal/cabin view camera. I'd imagine it will sooner or later get detection for potential theft and kidnapping situations, where it can simply detect the driver by face and prevent driving if it doesn't recognize the invidual as one granted driving privileges.

Like when fingerprint readers were added to car doors in the 90s, and carjackers started cutting fingers off to get away...

That is a largely incorrect statement that is loosely based on a single incident, not a trend.

The single incident was an individual in Malaysia who added an after-market finger-print based engine immobilizer to his car in 2005. The attackers threatened the individual with machetes, so that he would put his finger on the sensor, and then drove off with him in the car. The attackers later cut off his finger believing it would let them restart it without him present.