> They "were all deceived", in other words none of them ever checked

While I agree to the larger point you are making, I am hard pressed to understand what they could have done. Its not like they were not involved at all, there are plethora of accounts of these people receiving reports which just lied. They were blocked from access to the actual equipment for "security reasons" so they couldn't get a third party assessment done. At some point you have to believe your business partner will not outright lie because otherwise how do you do business with them. Life cannot run on cryptographic proofs.