I don't think the issue is that a bad contractor worked for the company but that they prob had admin permissions and were likely doing nefarious things with som

I don't think the issue is that a bad contractor worked for the company but that they prob had admin permissions and were likely doing nefarious things with some APIs with those credentials. Things like this don't ruin a company though. The company should immediately file an injunction and claim against both the developer and Google. They should have done that immediately. I think they have no clue or simply don't have the money to pay an attorney so there isn't much they can do. Heck an employee could steal all their money and unless they are willing to file a lawsuit there isn't much that anyone can do.