DMV can't afford the kind of external auditing that would've caught this. Not with their current budget. Setting aside taxes etc, what do you propose a public service organization should do in these situations other than trust a company to do what they're saying?
edit: removed a statement distracting from the two questions.
Usually, the prevailing wisdom of HN will respond to such a statement with "if you can't afford to do it properly, you shouldn't be doing it at all".
So you have to consider if you really care about the privacy that auditing would bring. If you do, then increase the budget.
It wasn't intended politically, but rather to say the tax situation is a known quantity already which is why the second question asked to set that aside before answering.