The term implies the existence of a contract. By his own clear statements Dmitry did the firmware on his own as a volunteer because he liked the RP2350 and wanted to to contribute to the badge project.
Yes, he probably wasn’t a subcontractor in the legal sense. DEFCON wanted to say “we didn’t directly work with Dmitry, we contracted EE and they got Dmitry to write the firmware” as I understand it. DEFCON probably doesn’t know/care about every relationship EE has to their contributors.