They could be paying licensing per user for some third party solution that meets the security requirements of stuff like remote unlocking. (Yeah, they also could do it themselves, at the cost of hiring a couple security experts, and the scale should make it pretty cheap per car, but a lot of the times companies like to hire it out so they have someone to point to if there are flaws.)
They could also just not care and do a shitty job, but doing the software part correctly isn't free either. But yeah, cellular with how little they use it and economies of scale isn't going to be a massive outlay, but it's something that makes some sense to have behind a paid service. Right now it's not a huge cost, but down the road, if they're paying for 20 years of cars worth of connectivity when most of them aren't used, it could add up to meaningful expenses that are pointless.