Their unique risk is "our remote access product broke (globally, or widespread) but we can't fix it because we don't have access anymore... because we use it to

Their unique risk is "our remote access product broke (globally, or widespread) but we can't fix it because we don't have access anymore... because we use it too and it's broken". You can cut off your own arms pretty easily even if you're not the vendor, but it would look particularly bad for them. Yeah in theory disciplined updates and testing should resolve the risk, but sensible to have a fallback.