Do you need to assess your vendors' vendors?

Formal assessment of every fourth party isn't realistic, since you have no contractual standing to request one. What is realistic: identifying which fourth parties carry concentrated or critical risk, then raising those specific relationships in your conversations with the supplier who introduced them.