You're mostly right, but for the sake of clarity, Slock.it is not a DAO, but a physical corporation in Germany. The actual chain looks something like

"The DAO" <-> "Proposal" <-> Slock.it

The idea is that the DAO 'hires' a contractor, which is Slock.it in this case, which can have all sorts of legal rights/protections/etc. and is a corporation in the physical sense. It gets hired by this nebulous entity, so instead of working for another corporation or individual, it gets hired by the DAO.