From my perspective, in common law, the company (ultimately the stockholders) would have civil liability for the damages it caused. These would be people stuck with a car that is worth less because it's more polluting than it was advertised, people harmed by diesel emissions, and perhaps a bunch to the government for health care costs.

Additionally, this was not just an innocent mistake. If it were merely an error on the company's part, they would still owe damages for the harm they caused. However, this was deliberate. The executives have criminal liability for defrauding the regulatory authorities and their customers. Even if the damage had been negligible, they would still have been guilty of defrauding the regulators. In this case, executives who signed off on false regulatory declarations or asked others to, should go to prison.

Now I know Germany has more of a civil law system, so it might be different, but the common law approach I suggest above seems just to me.