It's not that I'd choose a product specifically because it doesn't have references/used-by, but it's more that I get annoyed at vague allusions to usage by larg

It's not that I'd choose a product specifically because it doesn't have references/used-by, but it's more that I get annoyed at vague allusions to usage by larger companies. If the company in question actually uses your product, great! Tell me about it! But there's no legal guarantee that a "used by" statement is true - it's like saying "9/10 doctors trust this medicine I'm selling you". It just rubs me the wrong way. In your example, it's actually worse than annoying. If you're basing SOC2 compliant requirements on a "used by" signal, then the misdirection is potentially catastrophic.