They didn't write a defeat device to "fake" emissions, they wrote legitimate code aiming to make the car truly compliant with the requirements.
Then someone made this code not the default and, except when the car is under testing, loaded an alternate mapping of some key parameters which is more tuned for performance and mileage, at the expense of emissions. This is the criminal part, not the first.
E.g. detecting you are on a test stand, you might
* deactivate plausibility checks which would normally limit engine power * deactivate air bags and other inherently dangerous systems * ensure correct system behaviour even if sensors give conflicting information * suppress error logs for certain failed plausibility checks
The only illegal thing is switching to a "massaged" parameter map under these conditions. And presumably a single person controlled this switch.
When this general piece of software is set up to control a new engine from an OEM, a multi-year process of calibration starts. The engine starts of failing the emissions tests drastically and over time the calibration engineers tweak tens of thousands of parameters to try to get the emissions to be legally compliant.
This is not an easy process and the calibration engineers have a target, they have to get the vehicle certified for a certain emission class, which in turn is determined by the FTP-75 driving cycle. The news keeps talking about "defeat devices" because the law says that they are not allowed, but reality is much messier. There is nobody sitting there thinking about how to make crazy obfuscated defeat devices, rather there are a bunch of people trying to figure out how to pass the extremely demanding emissions requirement tests without any defeat devices.