Sure but for how long and in what contexts? Is it really reasonable to come out and say your company utterly failed a pretty basic security practice when faced

Sure but for how long and in what contexts? Is it really reasonable to come out and say your company utterly failed a pretty basic security practice when faced with a compromise but that it was really some other company's problem originally? Of course it's not. It's still your company's failure. Own it.