If the food was cooked to proper temperature, it would take a minimum of four hours for the food to develop enough bacteria to make someone that sick. It is a ServSafe rule to throw out any cooked food product after four hours of being outside the temp zone.
If the caterer cooked to temp, delivered and then the customer didn't keep it heated for four to five hours, that is on the customer. How dumb are these people to just let cooked chicken set for up to five hours and then eat it? Regardless of anything else, they share some of the blame.
Actually, the four hours is the aggregate time out of the food safety zone so you need to take the cooking time of the chicken into account also, until it registers 165 F. If you are cooking chicken "low and slow", you may only have two hours to get the food served before the four hours of total time outside the fsz are up.
I agree they didn't perform their due dilligence in educating the client as how to hold the product. What may seem like common knowledge to us is still a mystery to many in the general public.