Financial penalties applied to a company this size basically just get socialised. Either employees (generally innocent of this) lose their jobs as the company closes factories, or the price of future cars goes up, or even the company goes entirely bust in which case that doesn't actually help anyone at all. The only non-socialised effect of a penalty is to punish shareholders - who are also innocent of this (and arguably even that is socialised, since pension funds probably own large chunks of most car companies!).
The people who are guilty are the people who decided to install this software, who installed it, who kept it installed - and the people who were supposed to put in place checks to prevent this sort of fraud from happening, from the CEO on down.
The correct response for society, in my opinion, is not to try and apply a punishment to "the company", which is mindless and is only the product of people's decisions, but to make those people accountable. They were guilty of fraud, either directly (very serious) or by lack of diligence (somewhat less serious but still criminal). We have laws about fraud. Apply those laws, put those people in jail, and the next bunch of smartasses who think they can put fraudulent software in cars with this will think twice about it - and probably not do it.
In other words, this is a state, criminal matter. Approach this much like any other form of organised crime - investigate, offer reduced penalties for information, and put people who were guilty of this high-level organised crime in jail.