“If that is the case, it should be the agency that gets hammered, not the headline company, or they'll just keep churning out the same old rubbish."
That would leave the headline company with absolutely no incentive to perform any kind of due diligence.
"Yeah look. We hired the CEO's four year old nephew to design and implement the website. We paid him in Fruit Loops and performed no testing of any kind. How could we know the website would leak customer data?"
If the Racing Post, or any other mob, chooses to have a website, the buck *should* (well played ICO) stop with them.