That is solved with standard engineering practices. If you need to make guarantees about your product that are dependent on another piece of software, then you

That is solved with standard engineering practices. If you need to make guarantees about your product that are dependent on another piece of software, then you just have your vendor produce a spec and guarantee conformance to the spec, then you audit that the spec fulfills your fixed needs and audit that the implementation conforms to the spec. Then, if you made a mistake, your liability is limited to your mistakes instead of your mistakes and the mistakes of your dependencies. If, on the other hand, you do not get any guarantees from your dependencies, and you fail to achieve your guarantees then that is entirely on you as you are the one transforming the absence of guarantees into guarantees.