That's my understanding as well. It's been a very long time since I worked on the Hill, but shared employees are nothing new. I never had occasion to hire one or to work with one, so I don't have a feel for the situation. My impression, however, is that once shared employees are "in the system," Members' offices are likely to assume that they were vetted at the time of hiring by the sponsoring office. A chief of staff, for example, is having a tech problem that goes beyond the jack-of-all-trades guy in his office. Nor is he satisfied with the generic help desk maintained by the House or Senate. He calls around. He's referred to a shared employee arrangement, he's told by other offices that "these guys are great," he runs his problem by them and is satisfied with the answer, and before you know it, he's allocating $10,000 a year (or whatever) from his Member's clerk hire account as a retainer for their services. He will naturally assume that due diligence has already been done, since the consultants are already an established presence.
The question is who brought them in the door to begin with, and who was supposed to be monitoring them on a regular basis. The House security office has some 'splainin' to do. I hear gossip from time to time that suggests that Congress generally is abysmal with regard to electronic security measures. A LOT of people, for example, knew about Hillary's homebrew server while she was Secretary of State, but no one did anything. They didn't want to make her mad.
speaking of Hillary’s home brew server, then check out the note about the Awan’s thin client (zerohedge reporting what daily caller reported.
Actually, this whole article should brought back up to the surface.