> Sure but the problem in the HuggingFace incident is that they were not.

Of course they were, even if indirectly.