Then by the time you can see what they actually provided, the company is already bankrupt and if what they provided is non-compliant or otherwise useless, it's too late.

There is no excuse for not providing it from day one. And more than one reason to do it -- not only do you verify that you have what you need before they're gone, it allows people to find vulnerabilities sooner so they get patched before more people have the vulnerable device.