How it's checked:
It is compared with NHTSA's own SQL functions on the original dump in PostgreSQL. There were 0 unexplained differences on 11,000 VINs. It matches the live API on 95.4% of 1,000 VINs. The rest is newer live data.
While doing this I found that spvindecode in the PostgreSQL dump never applies VinDescriptor overrides. I wrote it up in docs/NHTSA-ERRATA.md.
Limits: only vPIC is fully live. Recalls and fuel economy are partial, and complaints/NCAP are planned. Corgi is a similar project, and I haven't benchmarked against it.