But surely DEF CON know that isn't true, because Dmitry evidently provided them with the firmware after the "stop work" order to EE (otherwise it couldn't have included the easter egg).

That’s a good point. From reading DEF CONs statement again, I could imagine that they would claim they issued the stop work order and then got delivery of the current state, which then included the Easter egg. That’s the only way I can come up with where this makes sense. It’s also not clear to me if DEF CON really got the firmware from dmitry or if he gave the firmware to EE which then delivered it together with everything else to DEF CON.

If he was working on the firmware until the moment of his flight to Defcon, then clearly they were happy to continue taking his time and effort for free.

This also seems to be implied by Entropic, which say they did work on the badge after DEF CON stopped paying them for it.

The term implies the existence of a contract. By his own clear statements Dmitry did the firmware on his own as a volunteer because he liked the RP2350 and wanted to to contribute to the badge project.

Yes, he probably wasn’t a subcontractor in the legal sense. DEFCON wanted to say “we didn’t directly work with Dmitry, we contracted EE and they got Dmitry to write the firmware” as I understand it. DEFCON probably doesn’t know/care about every relationship EE has to their contributors.