But even if I take it as true, doesn’t mean that DEFCON couldn’t have believed he was subcontracting for EE.
Similarly if it was DEFCON who introduced the firmware author to EE, EE might believe the firmware author is with DEFCON.
Obviously the contracts should be crystal clear about who is with who, and who is responsible for what. We hear that the fimware developer had no contract with anyone. That is very bad. But whose bad it is?
If there is a contract between EE and DEFCON which states clearly that EE is responsible for the firmware that is very bad for EE then.
If there is no contract between EE and DEFCON, or it is not clear enough who delivers the firmware then that is very bad on DEFCON. (I would be surprised if that is the case, but who knows in this whole mess.)