Glossary
Delegated vs application permission
A delegated permission lets an application act on behalf of the signed-in user, limited by exactly what that user can already do. An application (app-only) permission lets it act as itself, with no user involved and limited only by the scope granted.
It is the distinction that matters most in a security review and the one vendors are least clear about. With delegated permissions, an employee who cannot open a list will not see it through the component either. With application permissions, that limit does not exist.
SharePoint Framework packages request delegated permissions through the API access page. If a vendor asks you to consent to something in the Entra portal instead, that is a different and broader kind of grant, and worth a question.