Immobilizer question

[jsmythe]

My CPO NX200T came missing one fob and the dealer replaced it and the new one is now programmed.  I asked them if the missing one, if found could potentially be used to enter and drive the car away - in this day and age, anything is possible (the PO would know the VIN right).   They said yes, the third fob is still active since it was a duplicate.  I thought immobilizer codes were unique and were all married to the system.  They said to be absolutely sure, I needed two new fobs!  This just doesn't sound right.  Any help would be appreciated...