If nothing else, I imagine if the vendor were to get hacked, the client would have obvious grounds for a lawsuit. Obviously you'd rather it not get to that point, but, still.