In Batman Returns, how does the Penguin and his Red Triangle Circus Gang manage to get not only the Batmobile's blueprints, but also find a way firstly to remove the Batmobile's protections (locks, security systems and cocoon armor plate) and then to override its features, gaining complete control over the car?
Just before he shows Catwoman the blueprint, he makes mention of the fact that he's a mayoral candidate (and hence a member of the establishment). It's at least feasible that these records were held by the city and therefore readily accessible, at least to someone as well respected as a potential mayor-in-waiting.
Note also that he insisted on being left alone in the city's "Hall of Records" a few scenes earlier, the ideal place to find these sorts of details if they'd ever been submitted.
PENGUIN : Are you perchance a registered voter? I'm also a mayoral prospect.
CATWOMAN : I have but one pet cause, today: Ban The Bat.
PENGUIN : Oh, him again. He's already history -- check it out.
Penguin gestures at the wall ... detailed drawings and blueprints of the Batmobile, inside and out.
The Batman Returns novelization states that the Batmobile plans were obtained by Max Shreck, likely purchased from the actual designer/fabricator of the vehicle or from a disgruntled employee of whomever designed and constructed the vehicle. Most likely, they are not the actual blueprints - as far as what they would have wanted in order to sabotage the vehicle - but rather someone's design drafts for making a replica - one of the background plot devices in the film that was removed while it was shooting was the commercialization of Batman with a ton of merchandise (a subtle reference to the merchandise blitz of the first film) which you can still see in bits and pieces including the Batmobile kid's ride that the Penguin had used as the basis for his physical setup to control the Batmobile - that could be authentic looking. If you look closely at the blueprints made for and shown in the film - which I have the official replicas of - there really is no useful information on them that would allow the Red Triangle Circus Gang to do anything to the car because they are actually nothing more than incomplete drafting designs for the external appearance of the vehicle and not technical documents with any detailed information about the inner workings and composition of the car's systems.
The fact that Bruce is seen trying to repair the vehicle - and has it fully assembled again - after it was sabotaged suggests that he does not actually rely on anyone for outside assistance, despite the logic of him not being able to design and fabricate his "toys". In the comics, Bruce is literally a genius because he spends his younger years studying anything and everything, well into his adult years, giving him the expertise to design and build equipment for his Batman persona. Unfortunately, the Burton films never actually depicted a "Wayne Enterprises", which is how the comic book Batman - and later film depictions - arms himself with vehicles and tech, so we have no real information about how the Tim Burton Batman gets his wonderful toys, how he picked up the skills required to be Batman, or where his moolah required to finance being a vigilante comes from.
When the Batmobile was hacked, in order to open the shields, they used the electronic Batarang that the poodle caught in order to reverse engineer the frequency that Batman used to remotely open and close the shields.
Once inside they used a remote access device of their own design to take over the remote access that Batman used earlier in the film to bring the Batmobile to himself.
The blueprints were only used as a guide as to where to hide the device, which the self diagnostics of the Batmobile later located for Batman allowing him to smash through the floorboard (wow that is some hard hitting) and feel around in order to rip the device out of the mounting and disable it.