But the issue is about who's paying for it, not who's doing the contact.

The insurance company is covering it. An insurance company is not required to keep their financial expenses limited to just individual company pools. If they wanted to cover the costs of a high risk pool by taking funds from a low risk pool, they would be allowed to do that. There is nothing I am aware of that legally prevents an insurance company's left hand from financially knowing what the company's right hand is doing.