I am surprised they sell new cars without an immobilizer installed. Seems like such a trivial thing to install compared to all the other electronics in a vehicle.

It's not mandated in the US, unlike the rest of the world.

We have to stop expecting companies to do the right thing on their own. They won't. They never will. Pass the damn regulations.

how is a software update supposed to fix this? not being rhetorical, i'm honestly wondering.

For models that have an engine immobilizer on higher trims and use that same engine on lower trims the immobilizer is likely included in every engine built but just not activated on the lower trims. A software update can activate it.

What so they do?

[removed]

Not a mechanic, but it could be that when the ignition is activated there are signals the engine computer (ECU) could use to decide whether or not it will allow the engine to start/run. Maybe those signals or measurements look different when a key is inserted and turned vs. someone smashing the ignition cover and hotwiring.

VW was able to tell when their cars were being emissions tested vs. driving normally and cheat the tests, so there are tricks that can be pulled.

Or I could be completely wrong.

I believe in the VW case they checked to see if the wheels were turning quickly but the car wasn't moving.