There is an entire practice of cyber risk analysis, and most of the companies I work with do this type of due diligence as part of their vendor management process.

Yes:

* you do ask about things like budget allocation, audits, and internal compliance processes.

* you do ask about the tech stack, how it is maintained, and what the patch and disclosure policies and SLOs are

No:

*you do not rely on what figureheads say publicly; none of that is binding in the way legal agreements are

And if you're a vendor, your deals desk probably has all of these answers packaged up and ready to go; or even published on a website like this https://spyglass.trustshare.com/home (no idea who that is, it's a random company's compliance portal I found while googling my employers compliance portal provider).

[edited for formatting]