as part of a review process its not just the developer that wrote the code who gets blamed, its also the reviewer of said code.

Analog

sure eMudhra needs to be investigated and confirmed that even a small part of their business hadn't been used to compromise (it doesn't matter that they left the business, it matters that the investigation continues)

but also we need to see how it is this even happened, who dropped the ball and approved the bad code/behavior to enter in the first place??

or is this a structural issue where we need to introduce more checks/balances (tests)