You are missing the point. EA did not cancel the deal 'anytime they wanted'. EA cancelled it after they flagged that the terms of the agreement had been violated.
Should EA have the ability to determine if the correct car is used at the time of charging, and prevent the session? You and I might think so, but there is no legal requirement for that. In this case it was caught after the fact, and action was taken. The also do not currently have the ability to monitor and enforce the 60 minutes between charging sessions, but that does not mean that that could not cancel the contract if they did an audit of the system (At this point they seem to not deem it worth the manpower to conduct this).
As for being hacked, that is on the users end to control, not EAs.
Legally it really is simple. the OP (or his son in this case) violated the terms of the contract. EA exercised their option to cancel the contract as a result of the violation.