Researchers found every car they tested sent data to outside companies, and many companion apps shared drivers' locations and VINs.