Generally, how far downstream does the US State Department expect companies to vet vendors for sanctions violation? Due diligence this many layers deep is expensive, especially if hostile (investigative work to proactively discover dishonest sourcing reports.) I would think it would vary by industry--e.g. animation is obviously less stringent than medical devices so would have fewer reporting and certification struct…
So all that's required would then just be to outsource it to a bunch of companies who then outsource it and then claim you have: "no knowledge"? You're the one outsourcing, so it's your responsibility. The entire chain.
In other words, when a problem like this is discovered, the US State Department will assign more blame to the company if their attempts to avoid violating sanctions fell below a threshold; what is that threshold for the arts industry.