I'm always baffled when companies try to pass these issues off onto one of their sub-vendors - especially for critical issues like this.

I didn't choose YOUR sub-vendor. You did. It's your responsibility to ensure that sub-vendor is operating at your standards. Passing blame to a sub-vendor indicates an unwillingness to take accountability.