If this was in fact the origin of the compromise, I do wonder if there might be legal liability here.

Hey, it's more secure than 'solarwinds1'. ;-)

Their software allows network traffic to be monitored for some of the most important government agencies we have: the White House, the Pentagon, Treasury Dept, etc. They're not some retail company. Their tools provide a vector to attack extremely sensitive systems. Network monitoring and management is by definition supposed to be secure, especially for critical systems.

They have 6 tools listed on their IT Security Downloads:

- Access Rights Manager: Manage and audit access rights across your IT infrastructure

- Security Event Manager - Improve your security posture and quickly demonstrate compliance with an easy-to-use, affordable SIEM tool

- Server Configuration Monitor - Gain visibility into systems changes and easily compare configurations over time with our new change monitoring tool

- Patch Manager - Patch management software designed to quickly address software vulnerabilities

- Serv-U Managed File Transfer Server - Enhance security and control over file transfers in and outside your organization

- Serv-U File Transfer Protocol Server - Simple, affordable, easy-to-use FTP server software

While I wouldn't call all of these security sensitive, but considering some of the other tools that they built:

- Dameware Remote Support: Remote control and systems management tools in one easy-to-use package

- Dameware Remote Everywhere: Deliver the tools IT professionals need in a cloud-based, remote support solution

- User Device Tracker: Network device tracking software designed to locate users and devices on your network

they definitely count as a security-sensitive vendor.