I have just discovered this issue after buying a second hand MG4 from an MG dealer. The dealer didn't tell me that the car can be 'bound' to a user through an app and as a first-time EV owner I had no idea - I discovered it because it dawned on me that there might be an app. When I tried to bind the car, I then discovered it is already bound to previous owner (and I can see his mobile number!) I phoned the number listed in this trail and a pleasant person who agreed with my concerns said he could not help and the people who can don't work at weekends (today is Saturday)! He gave me an email address and I have emailed, but I now need to wait for two days uncomfortably with the knowledge that someone I don't know can track my location and open my car.
It's really shocking that, despite knowing this for some time, MG have not recitified this problem and their dealers do not inform and help customers with it. I am beginning to regret buying an MG.