Re: pay that same third party more money and hope the problem fades away
"They will likely just pay that same third party more money and hope the problem fades away, still with no idea of what is required to secure our data."
Just like outsourcing in general then. You can outsource the work and pay the money to some other organisation, but you can't outsource the responsibility, and usually you can't outsource the risk either (that's not what outsourcers do, is it).