It’s certainly a requirement in the UK of a car sold under VW’s Approved Used scheme that all keys are present. I’d expect the same to be the case under VW’s CPO programme in the US. If so, then if a car only has one key, it shouldn’t be eligible to be sold as CPO.
I’d also be a little concerned over the whereabouts of the missing key; if whoever holds the missing key knows the whereabouts of the car, there’s nothing to stop them gaining access to it. IMHO the dealer should provide a second key and reprogram the one original key that came with the car plus the new key. By reprogramming the keys, it effectively disables the missing key.