I started to manage a Joomla site with VM and see that the Joomla version is 3.7.2 and the VM version 3.0.16. I read on the VM site that you must first update Virtuemart to version 3.2.2 before you run the Joomla security update to 3.7.1.
So now it's too late...
What to do now? Please advice!
It is not too late. The issue is that Joomla 3.7 introduced changes that may affect the function of older VM versions. I suggest you update VM to the latest stable, 3.2.4 and then update Joomla to latest 3.8.1
VM files available at http://dev.virtuemart.net/projects/virtuemart/files
If you use template overrides then you may need updated override files for current VM versions, see http://forum.virtuemart.net/index.php?topic=135402.0
Test all updates on a backup copy of the live site first. There are more configuration options currently compared with VM3.0.16 so you will need to go through those.