Hi,
I'm sorry to hear about your vendor situation. Unfortunately, it's not uncommon. However, you do have a few options to consider.
Firstly, you could accept the situation as it is, use the best information you can get, and proceed with caution. Some regulators have acknowledged the limitations that organizations may face when requesting due diligence. As long as you can justify your decision to move forward with a vendor and provide evidence of your best due diligence efforts, that should be acceptable. However, it's important to remember that your organization is always responsible for the risks involved.
Alternatively, you could have a call with the vendor and explain that it's unlikely for you to become an "enterprise client" when they cannot act in the best interests of their customers by providing information that will validate their controls.
My personal favorite option is to engage a professional risk intelligence firm to provide you with a report on the vendor's cyber security profile. You don't need to ask the vendor's permission to gather this data, and these reports can be extremely valuable when you need to supplement missing due diligence documentation. Risk intelligence can be leveraged for one-time reports or on a subscription basis to supplement ongoing monitoring.
I hope this helps, but I'm always interested in hearing what other members are doing.