It says their cybersecurity obligations don't justify blocking car servicers from accessing car data.