I just tried this a couple different ways:
- Removing permission for "nearby devices" - this unfortunately appears to block both Bluetooth and NFC permission
- Turning off the phone's Bluetooth - NFC still works while the Bluetooth radio is off, but you'd basically never be able to safely use Bluetooth anytime you aren't watching your car. Setting a PIN is still unfortunately the only way to go, and hope that a dedicated attacker doesn't also find a way to capture your PIN (e.g. camera zoomed in on your screen).
Ooh, you beat mine: 848330 (unfortunately, mine was hacked over 5 years ago, and by the time I realized, their logs didn't go back far enough for me to validate that I was the original owner)