Prior to downloading the update, does the card have to be locked to the car? (60 mile break in/VIN Lock)
Short answer? I honestly don't know. I found the European version of the FCA website that provides information on the Infotainment System for our vehicles, and if you go to the navigation section, you can download an install guide in .pdf. If you go to the North American version of the site, it will want you to select country and language, as well as year and model of Spider. I think you have to enter 2017, as that's the only model year it seems to recognize (which tells us something about when the site was last updated).
I've read through that new guide, and nowhere does it state that the card has to be VIN locked to perform an update. BUT, that could be an omission based on the assumption that people have already driven the car enough to VIN lock the card before needing an update. Or maybe not. When you create an account and register with the site using the Toolbox, it always displays the VIN of your vehicle in the left pane of the app when you log in, as that's part of the authentication process... and it may also use the VIN to perform a geographic check to see which map updates you'll have access to. Understand this is speculation on my part.
If no one else can validate if you can update a non-VIN locked card, then here's what I'd recommend to protect your investment...
Clone your OEM nav card, and then use that copy to test with the Toolbox/Naviestras site. That way if something blows up, you still have your original (OEM) nav card, and you can clone it again for later use.
Give it a shot. Worst case scenario, if it doesn't work, you just need to go for a little drive and repeat the process.
Here's the link to the European FCA site I alluded to:
124 Spider Infotainment System