I think you hit the nail on the head with something that I've been wondering about for a while. I do audits (TDD) for a living and I actually take my job serious. I invest a lot of time into gathering all the information available on the company and try hard to figure out what the main issues facing a company are before I even go there. That means that when I go and look at a company I
really look at it. This has two possible outcomes: the first is that the company is actually flattered that someone would take them - and their investors - serious enough to spend the time to make sure everything works and works well. They'll be proud to show someone that spent the time and effort to get to know their company and product how good they are at their jobs and how well their product is put together. If stuff surfaces that is not 'ok' they either know about it and have a plan of mitigation but simply not enough time or other resources and if they didn't know about it they're grateful for the sincere feedback and will fix things as soon as possible.
The second possible outcome is that a lot of stuff surfaces that the people running the company may not even have been aware of and would rather not be aware of.
This all in contrast to the same job being done by larger companies which tend to output super nice and glossy reports that are essentially 50% gray paper, there isn't anything you could do with a report like that except for pretending that you went through the motions of doing your job.
My reports by contrast are usually 20% the size of the competition without any graphs or other distracting elements but are full of actionable advice and clear guide as to whether or not I believe the investment is a good one or not and why. This doesn't make me a whole lot of friends but the results are there and I stand by every word I write.
For the life of me I can't imagine that VW with the budget they have and the amounts of money at stake would not give their compliance department the tools and the authority required to do their jobs. I'm still waiting for the other shoe to drop, someone leaking a mail archive from VW internal correspondence (assuming evidence has not been destroyed, which would make them look even worse) or something to that effect.
This goes way beyond a single arm of VW, it just isn't possible and if it is then it is (counter-intuitively) actually worse for VW because it may mean they are not compliant with a whole bunch of other laws as well.
In that case essentially any VW vehicle would need to be re-certified for all aspects of a road worthiness certification because they have make it plain that their compliance departments are toothless paper tigers. And that might be a much worse path for VW than the one where they simply and openly admit to malice with respect to this one single aspect of their products.