Such third parties arent the third parties that you are thinking about. Think of contracted security vendors in finance sector, with experts auditing things etc. Not some subscription-powered bot running some scripts somewhere.
The point I’m making is that the statement made is vague enough that you don’t know whether or not that is the case.
Yeah. Similarly the arguments against Patreon's move are vague enough. Nobody defines what is the objective standard for 'enough security'. Nobody even asks "Why Patreon had a 5-person security team and multiple security vendors up until this point".