Transparency is good, but I think it’s also important to impose contractual liability and fines too. GDPR has a good model here; a data processor must list all of their sub-processors, AND have contracts with each that let them enforce transitively your data deletion rights.

This guards against the case where a processor transparently updates their ToS to share your data with someone you do not consent to.