> I suspect that VW has someone who's been there a long time, who is a "lead," and just doesn't understand basic security concepts. Some newcomer challenged them

I worked in Automotive for quite a while, and this wouldn’t surprise me. A lot of the roots of my company was mechanical engineering, and software at the time was very secondary. It was changing rapidly (and positively) over my last few years.