Did ask about replacement keys or locks - different things with different prices - when the new key is programmed to the immobilizer, the first step is to wipe the existing keys, so you need all the keys that you have present so they can be reprogrammed. At the end of the process the immobilizer will only recognize the keys that were programmed after the wipe.
How so? Theoretically if someone finds the keys even if i change the remote, they can open the door manually? Or not?
If someone finds the key AND knows where the car is, yes, they can unlock the door manually, they won't be able to start the car. What's the probability the person finding the key knows where the car is?
Your options are ...
a) Pay what the dealer wants to change the lock(s) - this should come with two keys, you'll probably need to pay separately to have the keys programmed to the immobilizer.
b) Purchase a new remote key & have the dealer program the key(s) to the immobilizer, and accept that there is a risk of someone finding the missing key and knowing where the car is.
c) Have a locksmith clone the remaining key, and accept that there is a risk of someone finding the missing key and knowing where the car is.
d) Drive the car with the one remaining key, accept that there is a risk of someone finding the missing key and knowing where the car is, accept that you may lose the only key.
When considering the options please bear in mind that anyone can come along with a rock, smash the window and open the car, no key required, or a tow truck and take the entire car, again, no key required.
One last thing - did you buy the car new? If not, does the previous owner still have a key that will unlock and/or start the car?