In my experience, this is more for data protection reasons than anything else. Companies are simply paranoid now about any computer on the network for fear cust

In my experience, this is more for data protection reasons than anything else. Companies are simply paranoid now about any computer on the network for fear customer data leaves. At my company, when we have worked with third parties who demand this (which is common), this is the reason. All the other issues you cite can be solved by dictating a tech stack to your contractor - they will follow, as can of course be sued if they do not. Non-functional requirements like these are relatively easy to gather.