Source please, as I understand it current VW cars themselves are not vulnerable but some other VAG brands still use these vulnerable immobilizers to this day. That might be bad reporting though. The only reliable detail I have found is from the paper itself. "We understand that measures have been taken to prevent the weak key and partial key update attacks when the transponder was improperly configured."
> It’s long fixed, and only a tiny set of cars (only high-end models with keyless entry) were even affected at all.
Some of the models on the list feature neither keyless entry, nor are high-end (the Audi A2, for example). While the Audi S2 may be considered high-end, it certainly wasn't available with keyless entry, and I wouldn't be suprised if the Audi 80/90 (which the S2 is based on) were affected, too.
Well, that’s nice – you have a car where you now disabled the immobilizer, but you’ll still need at least large tools and half an hour to break the steering wheel lock and the other stopping mechanisms.
Especially in cars without keyless entry the immobilizer is only one of dozens of mechanisms against theft.