I use Login.gov; “vendors” here probably refer to the NSF, NIH, etc. who, though government agencies themselves, are technically contacted with Login.gov and meet definitions of vendor.

So, my guess is they aren’t selling the data to vendors, just that vendors get the login “username” and authentication.