But the companies are not running the systems, someone else is, it's the whole point of the subcontractors and shell companies.

My uni got hacked, but the data is conveniently handled by a third party with 3 employees who just declared bankruptcy, and no one had to pay anything, and there was a new 3 employee cloud form popping up who could be the new vendor.

The software world is run this way