I suspect that someone quite casually removing bikes from a roof rack would hardly get a second glance, except from the owner. That’s why my row bar bike carrier is locked to the car and the bikes locked to the carrier with a substantial lock.
In terms of brass neck, there was a viral video a few years ago of someone trying to nick a bike off the back of a car that was stuck in traffic, while also on a bike.
They are not that heavy compared to a mountain bike rather than a light weight sprint bike. 15-20kg but I agree there are some dodgy bike carriers available
My Thule carrier was locked to the car and the bikes were chain locked together and to the carrier frame. Good quality locks but few are unpickable by experts.
Nasty little wafer locks, can rake them open in under 30 seconds usually, thats the ones securing the roof rack unless the others securing the bikes are better?
Roof rack fittings that clamp to the gutter or integral longitudinal bars are easily forced although my last two cars have roof rack fittings which bolt the feet to nuts in the roof structure. The chains securing the bikes to the rack were cut with bolt croppers and the locks left intact.
Ever since the theft bikes travel, dismantled, inside the car.