Comment by magicalhippo

Obviously, and this is something they should communicate clearly.

But if they were to provide such a "service" I'd expect them to minimize exposure, including the steps I mentioned.