I concur, as someone who also works for a vendor to higher ed.

I know of small universities that demand an independent audit of all vendor code, to the large universities that are ok with having a four-character password for database access.

It also seems that Canadian universities are far more serious about security than American counteparts.