Unless VW is significantly different than GM and Daimler, Megamos likely had very little control over the protocol and messages being sent. They would be given a simulation of the vehicle bus that they would be expected to duplicate exactly. A full spec would be given providing state diagrams for each message and its handling. Megamos engineers would be able to offer suggestions, but the message structure and overall protocol would have been outside their control.

Right, because VW should blindly build parts into their vehicles without vetting the security they bring (especially when said part is in fact a security component). Tougher to do when vetting such a part requires expertise in the field, but blindly trusting the supplier is never a good practice.