The gov is absolutely responsible. They chose the vendors, they implicitly (or explicitly) approved their storage policies. The time range for these 'temporarily stored files' was Jan 1 to Dec 10 2020, aka a whole year.
Yes, they are responsible to their users, but I'm going to guess that they have been put into a tough situation to modernize and increase in scale while also dramatically reducing budgets.