[yebyen]

They (his vendor) are undoubtedly insured, if something goes wrong he will of course have someone to sue. No problem!

[bsder]

Exactly. This is why you outsource--"Not our fault. Throw them in jail."

[allegory]

Exactly this. Business is not about providing optimum security - this is financially impossible unless you have a black ops size budget. It's about protecting one's ass as best as possible and having mitigation in place for anything that may be your fault.