If there are .svn directories still present, it's likely that they just copied a working copy to their web server. You're supposed to use "svn export" to create a "production" version without the .svn directories. Or just delete them. Either way, this is really VCS misuse more than anything else.
Using subversion for deployment is a common practice. They should be blocking access to the .svn directories via web server configuration.