There are two types of people, people who take responsibility for things that aren’t directly their fault, and people who regularly experience negative outcomes.

Okta chose this vendor and they chose to have them store this data. They probably even have security requirements in their contract with them. They could have prevented this. And when you present yourself as a security company, you’re expected to.