Exactly. There is an existing legal and moral framework for precisely these sorts of situations. It seems to work very well for the emissions scandal too, so why mess with it.

Even if the programmer was fully aware of what they were doing, VW would still be the only party that's legally and morally responsible for this.

(And may God help whoever made the Therac-25 mistake, just imagine making a bug like that)