The make/model/package MPG figures come straight from the manufacturers, who usually don't even test production models, but pre-production engineering prototypes --engineering prototypes!-- and report that figure for as many production years as they like
According to the EPA itself: "How vehicles are tested" https://www.fueleconomy.gov/feg/how_tested.shtml
Each year EPA tests a random sample of maybe 10% of the base models on the market. Note: this is a much smaller number than the various "apparent models" (variants, options packages, etc.) that a consumer might feelare different cars. Aside from perhaps testing a second engine option in a given model, the EPA ignores those variants and doesn't even require tests to be conducted in successive production years because it feels "MPG probably won't change much from year to year" and "almost no options would affect indoor dynamometer results anyway -- we know it's a poor test". Aerodynamics is just one the options that significantly impact real world MPG, but won't show up on a dynamometer
Therefore MPG numbers are just a manufacturer's own claims, subject to spot-checking by the EPA. Apparently VW, Kia, and others felt the risk of spot check was small enough to ignore.