VW can demand transparency (e.g. access to supply chain facilities by 3rd party auditors) as a prerequisite to doing business with a partner company. It is absolutely standard to demand that business partners have had 3rd party audits to prove they comply with laws and regulations. This is not some insane ask, this is everyday stuff in the business world.
If a company can't or won't get an auditor to validate that they comply with PCI-DSS, for instance, they're not going to be signed on for processing payment card information by other companies.
And slave labor is a tad bit worse than retaining too many data fields in a credit card for too many days.