The Treasury hack is sparking new questions about how agencies ensure the security of third-party technology service providers.