By hiring this outsourcer and giving them access my account, AT&T is giving their stamp of approval for this company to act on their behalf and be, for all intents and purposes, AT&T as far as the end customer is concerned. They are backing up the reputation of this company and quality of their work with their own brand identity.
It is a terrible idea to make an employer responsible for everything an employee does. It is the responsibility of the employer to have a level of diligence to protect their customers, through policies and actions, but that doesn't mean that they can predict and control everything that a human being will do.
The fact that a $25 million fine was imposed says that the government believed that the appropriate level of diligence was not taken, but I see nothing to suggest that the negligence was great enough to justify destroying the company like some people apparently want.
It's like if a buy a car and the automaker has issues from a part failing. It's ultimately the maker's (GM's) fault. Not the producer (some company in China) of the individual component.
Car analogies suck, but if the producer of said component got those components into the car by deceiving the automaker, then you bet it's that producer's fault, not GM's.
GM might be responsible for restitution (fixing the problem parts -- which they'd ultimately get the money for through legal action against the supplier), but it would be utterly inappropriate to levy huge punitive fines against them just because their supplier provided faulty parts.