I don't understand how we allow these companies to protect each other even in the face of egregious malpractice.

This might even be a PR move. They fucked up and can merely say "a third party" did it. Who's gonna verify this?

Unless we have whistleblowers we will never know. What a disgrace.