Yes, CAN is not safe enough and can be hacked.

Therefore, Bosch used another interconnect bus for the Smart System that provides several theft protections.

Now, if thieves put the bike in some enclosure that cut the tracking, they can still make the bike disappear but the ebike components will be unusable.