According to the article, Sacks discovered the issue in January, and then forced the company to report it to the California regulator - if you believe that sequence of events, he can't really be held accountable for the action of Conrad.

Let's say you are an engineer, take a new role at a company to work on their database, and then discover that one or your managers has stolen money, do you think you should be held accountable, assuming that you report the issue immediately when you discover it?