And the seller can say “no” as well. It’s a scary proposition for old hats, but I’ve only ever seen it make a small number of buyers frustrated with the lack of special treatment (but buy the product anyway, and in all but one case turn our to be great, engaged customers).
SOC2 reports, SLA monitoring dashboards, 5% annual increase limits, they can put literally anything as a requirement.