I use Login.gov; “vendors” here probably refer to the NSF, NIH, etc. who, though government agencies themselves, are technically contacted with Login.gov and meet definitions of vendor.
So, my guess is they aren’t selling the data to vendors, just that vendors get the login “username” and authentication.
I paid for Kagi and have been super happy with it. If you don’t mind paying, I highly recommend it. Not having ads or manipulated results is worth it for me.