From my experience with Ford control modules, anything with any complexity may need programming to the vehicle VIN before it functions in a different vehicle...
Whilst that makes sense for security-related parts so the immobiliser cannot be simply bypassed - they also apply it to completely irrelevant items such as the Bluetooth audio module.
I'd not be at all surprised if it also applies to climate control, power seats and any other optional or "luxury" item, to try and prevent DIY replacement or upgrades.
There are two levels with programming the VIN. As you say, some modules are secured to the VIN and will only work when that matches. As you say, for some things that makes a lot of sense, for security or calibration reasons.
However, in my experience of the car industry, most modules are programmed with the VIN only as an electronic security marking. The modules can learn the VIN number of the car that they are on when told to do so, but only once. That can never be changed without completely reprogramming the processor, which can't be done over CAN. It would need the module opening and JTAG or similar to be used. The VIN becomes a fixed item, like the serial number. The stored VIN on most modules, like the serial number of the module, is just that, a number. The stored VIN in modules like this has no effect on the operation in a car, whether or not the VIN transmitted on the CANbus matches.
That is only done to make changing the identity of a car more difficult. All the modules can have the stored VIN read at any time, so if a car is cloned, and the master module with the VIN is changed or reprogrammed, and the physical VIN numbers changed, all the other module would have to be changed in order to hide the old identity. The idea is to make changing a car's identity cost more than buying a new one.
Of course, the technicians at the dealers will tell you that the module has to be programmed with the VIN, because they don't see any difference whether the module would work without programming or not. When they change a module, they plug in the diagnostic computer, it does what it needs to, and the VIN can be read from the new module. The technicians won't ever try an unprogrammed module, and even if it did work, they couldn't be sure that it would work in all conditions. All main dealer repairs are done with new parts, so it make no difference if a second-hand one would be fine, as they will never use it anyhow.
For the owner, programming of that type of module isn't needed. If it's a second-hand module, the VIN can't be reprogrammed, but that won't make any difference. If it's a new module, it will just read out a blank if the VIN is ever read. Either way, it will only be read if the car is suspected of being cloned, and one or two modules, out of 20 or more, showing no VIN or the wrong VIN is just evidence of repair not evidence of the entire car being cloned.
