Not so. There exist BOM analysis tools which are free for manufacturers of products to use - you just upload your parts list and your suppliers, and it works down the list either requesting info from the supplier or using pre-supplied info. The suppliers in turn contact their suppliers, etc. - it’s the suppliers who ultimately pay a few hundred bucks a year for access. At the end of the process you know exactly what’s in your doodad, get a materials compliance declaration, don’t poison any kids, etc.

This is something this manufacturer should already be doing, otherwise it’s unclear how they’re complying with RoHS or REACH.