It isn't merely being hacked.. if for some reason data gets exposed, it is easy to redefine the exposure point as a third party issue. For example, lets say an

It isn't merely being hacked.. if for some reason data gets exposed, it is easy to redefine the exposure point as a third party issue. For example, lets say an app allows you to install a plugin. However, the plugin API lets a third party run anything they want. I've seen firsthand how auditors will determine that it isn't the fault of the company they are auditing, irregardless that that the company provides a plugin API that allows for easy exploits because their software isn't technically the one exploiting the user.