Supplier Security Due diligence question

I have recently been tasked with performing due diligence checks on our suppliers and if their security is up to snuff (Certifications, relevant security controls, ect).

However, some of the suppliers listed simply provide native based software. For instance, Norton antivirus.

Seeing as Norton don't host the application on the cloud, and it simply being natively installed, Is a review of the supplier still required? And If so, what aspects of Norton do I review?

cybersecurity due diligence security