That's not a run race. They are a processor and this definitely was on their watch. Both controller (the website owner) and the processor and sub-processor (Lovable, Supabase) all have pretty clear joint and individual responsibilities here and all of them have failed to greater or lesser degree. The Controller may even be in the better position of the three.