ISOs members are the standards organisations of countries. Nothing else can join except standards organisations representing a whole country, typically a UN member state although the exact margins are a bit tricky (e.g. China and Hong Kong are both in ISO...)

So, in most cases an ISO 3166 code goes to an ISO member, they would propose what they think is the best option, and if nobody else objects they get what they asked for.

Where the country code is for some entity that isn't an independent nation state (e.g. VG and VI are for the two sets of Virgin Islands, one set belongs to the United States, the other to Britain) or for an entity that doesn't enjoy full participating membership in ISO (often very poor countries or those which don't have much diplomacy anyway so who cares what the outside world thinks) then it could be decided by somebody else, if they don't like that too bad stage a war of independence.

In some cases there's contention. For example the United Kingdom of Great Britain and Northern Ireland would like UK (and it has the ccTLD .uk) but Ukraine thinks it makes more sense for them to have it. So, neither gets it, Ukraine is UA and the United Kingdom is GB.

Presumably Germans thought DE was a better choice because it matches what they call themselves, whereas many other countries figured it makes sense to use their English name to choose the code, or they simply didn't care.