>So theoretically it was already being done by the vendor.

Organizations with good quality programs know how to assess their suppliers, including those who are ISO/ANSI certified. There’s a lot of information that goes into evaluating a supplier beyond just asking them if they certify their material or have a quality program, including doing site audits. Things can still fall through the cracks of course, but it reduces the probability. I bet if you asked them why they don’t evaluate each lot before the mishap, at least some would claim it’s redundant and unnecessary because the supplier already certified it.