Part of responsibility here is on SEC too IMO. When designing that "blueprint" format and data exchange protocols, they didn't implement mechanisms to verify correctness and completeness of data received.