There is no legitimate instance (outside a hospital etc) in which an adult unrelated male should be in a shower with a 10 year old child.
The person who saw the incident failed the child by not calling the police. From what I see, it was reported to Paterno, to whom it never occurred to ask Sandusky about it, he just passed up the pipeline, failing the child again. Higher management took no action, failing the child and those who came after him again.
I am especially disturbed at the musing that Paterno might have been embarrassed to ask Sandusky about the incident or at the very least investigate it internally, making the best determination possible, then calling the police if it was warranted. Instead, it was swept under the rug in the university bubble and this guy was allowed to continue abusing children for who knows how long.
Abusers count on people's lack of willingness to get involved to ply their trade. If something had been done, right then, to put the boots to Sandusky or at least talk to the kid or his parents, the guy's further crimes against children could have been averted.