Yeah, only the doors are alarmed, no ultrasonic.

The immobiliser can be 'emergency' defeated, but it needs a mechanically correct key and also access to the VW alarm/radio code database. (ie Either a dodgy dealer or social engineering). So it's not exactly a punk affair - they knew what they were doing.

The other possibility is that at some point they have 'borrowed' a valid key from you, used it to electronically adapt a mechanically correct key to your car, and then used that key later. But you'd have to wonder why they'd bother with the hassle. Why not just steal your car when have have your key?