The vendor-as-back-door pattern keeps recurring because the controls we apply to vendors are documentary while the access we grant them is operational. A security questionnaire is a point-in-time attestation; the vendor's VPN account is a live credential that works every night of the year. The pragmatic shift is to stop trying to audit the vendor into safety and instead minimize what their compromise can reach: vendor accounts in the same joiner-mover-leaver lifecycle as employees (most aren't - nobody tells you when their contractor changed jobs), just-in-time elevation instead of standing access, session recording on vendor paths the way you would for your own privileged admins, and network segmentation that assumes the maintenance account is already in hostile hands. The contractual lever that matters most is also the least used: an incident-notification SLA with teeth, because in these cases the hours between the vendor knowing and you knowing are where the money leaves.