Surprised he got as far as he did. Every line of code that touches production should be reviewed.
If it's shit, fail it until it ain't. To allow that shows a distinct lack of technical leadership.
You've since shown far more and that should build trust. Never trust contractors without verification.