Firstly, I admit that I have never been involved with recruitment at the very highest levels, which could be subject to different rules, but my guess is that the principles are the same. I have, however, been involved in recruitment and checks.
Firstly, vetting checks can't be carried out until somebody is appointed. That means that appointments are made conditional to security checks. People sometimes sit around at home and can't start work until the checks have been completed. That would explain why Mandelson was appointed before the security checks were completed, although it was a mistake to announce his recruitment until it was confirmed.
The public doesn't know why Mandelson failed the check and, as far as I know, doesn't have any right to know. Even employers are only told the outcome. For all anybody knows, it could be for something quite minor and Robbins took on the responsibility of overruling the check because, in his opinion, it was trivial. He evidently made a serious mistake.
It is conceivable that Starmer knew nothing of all this. Data protection laws protected Mandelson. That doesn't mean to say that (in my opinion) Mandelson was a good choice. I can understand the reasoning, but it was a gamble which failed.