I would not exempt those marketing and advertising vendors from due diligence. Due to the nature of those services, they do have a risk for UDAAP. Because of that, it is essential to see their compliance policies and employee training plan. I hope that is helpful, but I would love to know what other members think.
While the vendor is not changing your artwork, there is some UDAPP risk related to these projects. An example might be placing advertising announcing something like a credit discount or promotional terms for new loans. Per UDAPP, text size and placement must meet compliance criteria. Suppose the newspaper resizes your ad without your permission putting you at UDAPP risk. While these situations are not that common, they do happen.
My advice is to keep these marketing vendors in scope, even if they are risk-rated as low. In that case, you have some monitoring and oversight. In any case, scoping is at your discretion. Just make sure that the rationale for being in scope or out of scope is documented, and you apply same rationale to every vendor.