What happens is that your phone "exports" a modem. This is visible via Bluetooth and can be programmed using AT commands (in this case, AT+CMGW).
And those can be used by the SMS App to send SMSs, and also by the Toyota to do the same.
This can be done by any device that is paired (trusted) and has access to the Bluetooth stack.
Since SMSs are not stored ...
I am looking at a number of Cordova mobile apps at the moment, and
almost every single one of them appears to have the APP_SECRET
hard-coded in the Cordova config.xml file. Is this a major risk?
Microsoft does not consider it a major risk (neither do I), since the APP_SECRET value is used to map the app to an user account in App Center, and the App ...