Theory
What happens if the vendor is the one compromised?
The note recommends assessing what a compromised vendor's own access could reach, not only whether the vendor protects your data, and how you would sever that access without the vendor's cooperation. Third-party risk programs assess whether a vendor protects your data. They rarely assess the blast radius of the vendor's own access to your systems.
The inversion
Claim: recommendation
For each vendor with standing access, ask what an attacker holding that access could reach, how quickly you would notice, and how you would sever it without their cooperation.
Managed providers and remote-support tools usually have the widest reach and the least examined containment path.