If you read the actual court judgment, you'll find a slight nuance. The algorithm was invented by Thales. They licenced it to EM. EM and another company called Delphi make immobilizer equipment using it and then sell the kit to Volkswagen and others. The researchers informed EM; EM failed to inform anyone else. VW found out a few weeks before publication and were pissed off.
Which is not to blame the researchers (except perhaps for notifying everyone, rather than simply the maker of the one component they compromised) but it does explain why the judge was fairly scathing: "It may well not be the defendants' fault that Volkswagen were not told earlier, but once the defendants were told about Volkswagen 's concern a responsible academic, concerned with responsible disclosure, would have realised that publication should be delayed, at least for a reasonable period, to allow for discussion with Volkswagen."