Yes, he probably wasn’t a subcontractor in the legal sense. DEFCON wanted to say “we didn’t directly work with Dmitry, we contracted EE and they got Dmitry to write the firmware” as I understand it. DEFCON probably doesn’t know/care about every relationship EE has to their contributors.