The security nihilism is thinking you'd need special hardware to stalk someone, when a malicious app on the victims phone does the job.

The security nihilism is thinking "why try to defend yourself if there are so many attack vectors". Also, my phone has no malicious apps. (It's a GNU/Linux phone.)

IT's easy to replace a phone, a car not so much

Several of my cheapest cars (and quite a few of my cheapest motorcycles) have cost me less than my most expensive phones.

Car titles (and thus vehicle transactions) are public record.

I figure it's probably about 1000x easier to gain sufficient access to someone's car to put a tracker on it than their phone

Then can you explain why special hardware still keeps showing up in victims' cars?