Sorry to butt into a pissing match with some facts. But, several years
ago, my wife, who had already lost her set of keys to my '96 Lumina,
misplaced my set of keys (car was for sale in our driveway).
I ended up going to the local Chevy dealer, who told me in advance that
they needed the VIN, a copy of the title, and a photo ID.
When I went to the parts desk, they called an GM 800-number and entered
my VIN. A few minutes later, a fax came through referencing the correct
key to use (PASS-KEY) and the codes to cut it. 5 minutes later, I paid
the cashier $20 and was on my way with replacement keys, which worked
just fine in the car.
So yes, there definitely is a database at GM which matches VIN and key
codes. The VIN itself doesn't contain the codes.
If you could find a dealer that didn't require the title and photo ID,
and all you had was the VIN, it seems screamingly obvious that you can
get a key for someone's car where you just had the VIN, and that the key
could start the car.
Of course, if you had a new Ford, Toyota, or Nissan, you wouldn't even
need the key: