This is the same as experts say about home security. If someone really wants to get into your house, they can. It depends how much time and and effort they want to spend.
What you can do with good security is make the average criminal realize it’s easier to try the one down the street instead of yours.
WAG: rental cars don’t stay at one location; they are moved from location to location (and state to state, etc) based on demand and due to one-way rentals. The only effective way to guarantee that the car has two keys when it is returned to the manufacturer and sold as a program car is to tie both keys to the same fob.
The expedient work around is, always has been, and will continue to be a tow truck.
So unless you have a squad of Marines guarding you car it is much more likely to be towed then getting a key cloned.