Presumably you'd be lying about the thing they'd be buying too, or innumerable other things.
And 'subsequent lawsuit' is usually a powerful motivator to be honest.
It's literally a deal breaker to send back No, so there's a lot of incentive to do what it takes to send a Yes back.
And "subsequent lawsuit" is a very distant threat in this case.
Less cynically, there are some standards that do have some non-zero teeth in them. Some audits are challenging and at least rate "a good exercise". But that's what I mean by even if the vender truly believes they are compliant with ISO-Thirty-Three-Million-And-Two-Subrevision-A24, they're just one error away from ohnoyourdatabase anyhow.
The net-net of it all is that, as I sort of alluded to, are these assessments worthless? I mean, no, not quite literally zero. If you send one of these documents to a startup of two dudes and a cat and they claim ISO-Thirty-Three-Million-And-Two-Subrevision-A24 compliance, they're lying and the person examining their assessment at least has a chance to be suspicious about it. But in real terms, are they going to be the difference? Unlikely.
Or, let me put this another way. I would bet substantial money Okta has in their possession a response to their questionnaire from Rightway Healthcare in which Rightway Healthcare sings the praises of their immense, extraordinary, back-breaking, industry-leading security efforts, complete with citation of the relevant industry standards they comply with, and that it looks as good as anyone else's answers.
Yet, here we are.
A contract is a probabilistic promise.
According to the writer's understanding of the law (and the risk tolerance they have for being caught) these are the terms they're putting to paper.
Generally, that means the writer's legal team feels confident that if everything goes sideways and they're standing in a courtroom, they have the best possible chance at winning the case with the language they used.
Now everyone around legal (e.g. sales, marketing, product, etc.) likely has different incentives. But the entire reason legal is somewhat firewalled is because they're the ones thinking about that future courtroom.
So it's less "there's a certain degree of BSing" and more that sometimes sales gets their preferred language and sometimes legal wins.
And of course, sometimes neither of them know relevant technical details and both their proposals are jibberish.