A control module can have anywhere between 0 and a gazillion possible security access codes (or logins for that matter). The exact number is determined by the vehicle manufacturers specifications, that are then sent to the control module supplier and implemented during development. A code can do anything between enabling access to special diagnostic modes (like flashing) or adaptation channels, coding etc. In addition some codes only work when you're actually in special modes, none of these are usually relevant for vehicle repair related functions.
I've been running brute force scenarios similar to what spacewalker has described for a few years and even though the process comes up with numbers it doesn't mean you can make much sense from those numbers. What it boils down to, if you have adaptation channels that are blocked - that's a dead giveaway for a function behind a certain code. However, what if the module doesn't do adaptation at all or if there are no obvious changes once you enter a code? As I wrote, codes aren't all about enabling functions indirectly (i.e. enter code, then access function XYZ). Sometime the code itself will switch something on/off (similar to older cruise control activation/deactivation). That can be everything from developer messages on the CAN through a forced boot loader mode - neither of those are actually relevant for our purposes. That said, the different diagnostic modes complicate the situation. Meaning one needs to run a brute force multiple times, at least once for each mode. I have come across at least one case where codes where designed to be entered one after another, if you did things in the wrong order follow up codes would be rejected. Another complication to the brute force concept.
In opposite to what Uwe wrote, my practice for the last 10 years was to use a brute force process for some situations but it was certainly not the only way to get the necessary codes. There are only so many ways this can be done, somebody or something spilling the beans is in my opinion the most effective way because it reduces the amount of guessing and time wasted.
The real question to me is, are codes often overrated? Ok, with the latest BCMs you won't get far w/o the proper codes. But in general for how much stuff do you really need codes? Do we have codes for most of these things available? Just because doesn't display things doesn't mean we don't have them. Either we are still in a testing process or we deem those codes to be not relevant for vehicle repairs etc. - some of those are strictly too dangerous for everybody and his brother to play with. After all, there's a reason why VW/Audi specifies them as secret/security codes.
P.S.: If you're worried about this subject, you better don't read up on SWaP.
