[judge2020]

Sure, but companies also don’t want to deal with building the system themselves (especially if you want to support multiple countries) and dealing with potentially doing something wrong like violating anti-discrimination laws.

[lesuorac]

Surely you have some reasonability to vet your supply chain.

Not to say that your vendors have to be perfect, but if they have a known credential leak for 18 months that's pretty negligent.