i can tell you that in the "auto" business, they are ordered thru the parts department..you have to have the vehicle inspected to verify the vin,and prove ownership. There is a procedure to be followed, but it isnt over the top...as i said Body shops do it ll the time.
The owner of a vehicle can remove the vin tag if they want to. The original "incomplete vehicle" vin tag from GM that came on my truck is gone...I took it off the day I bought the truck...The "completed" vehicle tag that was put on by the "upfitter" or "final stage manufacturer" is there. And the orginal tag from them was wrong, it had the wrong GVW. I called the selling dealer and he had the Upfitter send me the right one...I installed it over the top of the wrong one....