With all the comments received I'll try to summarize. No, I did not have the key fob with me during the procedure. Yes, I know the person which is why I "allowed" him. Yes - him & I are both engaged in security products development, analysis and testing but in very different spheres.
My only reason for writing about it and contacting Mazda, Insurance (when Mazda never responded for sometime) and NHS was to get Mazda's attention. This happens regularly - in computers. A flaw is highlighted, its patched. I wouldn't call this a flaw, BTW. But rather a weak link.
Kudos to Mazda and they gained a lot of respect from my end - who took it on themselves, contacted me and finally a session was organized. I, obviously can not replicate and don't have my friend here nevertheless the core Mazda engineers carefully reviewed step-by-step everything with me. Finally, they left. I got some good coupons which I can use later on and they thanked me quite a bit. Bottom-line: the door open part can be done without raising any alarm. The point where we all were stumped is after starting the car, how my friend managed to move the gear from P, without shutting down the car and effectively releasing the steering wheel lock. I believe they themselves understood how since for a long time one of them were underneath the dash (driver side).
What's good is how serious they were, how seriously they took the whole thing and how professional they were. I had a good opportunity to clarify few things, ask about SkyActiv in general. They are all collectively very excited for CX9 since for them its a milestone which was extremely difficult it seems to achieve.