My guess would be that they haven't outsourced it because it would've been more difficult to go through the acquisition process than to simply an in house dev t

My guess would be that they haven't outsourced it because it would've been more difficult to go through the acquisition process than to simply an in house dev to build an upload form and do manual verification on the uploaded documents. If that is the case, then I'd be less worried about Little League selling children's personal data, and more concerned that it's all sitting unencrypted in an S3 bucket.