The person or entity who hired the prime contractor is also on the hook. If you are in that position, it is better to detect and stop a contractor doing things behind your back than it is to explain that you didn’t know that a contractor subcontracted the work to the person who installed the backdoor.