Duncan here. I'm the one who contacted BMW to ask about source code availability. I don't own one of the BMWs in question, but the chap who wrote the original article investigating the update contents did.

I've since been contacted by someone clueful from BMW Germany, and have put him in touch with the car owner. They are working together to determine what needs to be done for BMW to be compliant.

tl;dr: It looks like it's all going to be sorted out amicably.