I assume it has to be enabled with physical access to the vehicle, though I don't know this for certain. If they can turn it on remotely, then yeah, that's definitely bad.
I've been arguing about this article on another forum, and have been looking closely at how Musk is interpreting his own data - and he's being loose and fancy-free with it (both sides have engaged in embellishment, it seems). As a result, I don't think he's a shining bastion of honesty - I wouldn't trust Tesla any more than any other entity.