TL;DR McKinsey set up shell company to collaborate with Chinese government (which relies on corporate fronts like the US to manage public agency) and is trying to claim it was that shell company they’ve since shut down, not McKinsey involved.

McKinsey isn't a single company.

It's a bunch of independent practices that share the same logo, and have extreme autonomy between each other and "governed" by a committee of senior/managing partners from all the McK offices.

A McK practice can go rogue and it's hard for the others to push back otherwise.

That sounds concerning

Why?

That's how all consultancies are.

Consultancies gives advice, but it's individuals who are giving that advice.

If the advice is really really wrong, you don't want liability to taint the rest of the organization.

For example, look at what happened to Arthur Andersen after Enron and WorldCom even though majority of the partners were not in on it.

It's the same story of accountancies, auditing, and law firms as well.