Yeah, multiple languages or even putting an ê or something in an English password to mix things up. It makes perfect sense to allow.
It's a good thing they require each codepoint to be treated as one character for the length limit, since "🤔🤣" is 8 bytes on its own, but the unicode prefix is trivial to guess.
After reading that I'm still really confused who these cars were stolen from. From the sounds of things, the current owners are losing their newly bought vehicles only for them to get put back on a dealer lot, which is just insane.
Surely by now the original owners have already claimed insurance on their stolen vehicles? The police repossessing them from legal purchasers who were unaware just seems like it's making the whole situation worse.