Don't underestimate the simple effect that publishing the code will bring. If a car company knew that all the source code that went into the car would be published they would have to be comfortable with what might be in there because there would always be a risk of someone finding something. It's a bit like the asymmetry in security investment: the attackers (or emissions researchers in this case) only need to find a single issue to win, but the defenders (car companies) have to invest across a broad range of areas so there are no obvious weaknesses.
As a comparison, consider the difference in a developer's behaviour when writing code or a commit message in a completely private repository vs. one which will be published for anyone to see. Closed code only needs to reach the level that's considered 'normal' for the culture within the organisation. For many developers the quality threshold goes up for things that will be published more widely, even if the potential audience is small.
As a comparison, consider the difference in a developer's behaviour when writing code or a commit message in a completely private repository vs. one which will be published for anyone to see. Closed code only needs to reach the level that's considered 'normal' for the culture within the organisation. For many developers the quality threshold goes up for things that will be published more widely, even if the potential audience is small.