Should have been checked by both. Lockheed should have checked because of contractual obligations; NASA should have checked because of minimal engineering practices (bugs happen in all your dependencies).

They happen and some are put there on purpose too. In this case it's not a "bug" in your dependencies, and yes NASA since it's using public funding should have been more careful, but ultimately it's Lockheed that was paid to do something no?