Well they can already do that if they want to, so this system doesn't change that. Responsible vendors wouldn't do that though (and if they do, just don't buy their products)
They can already do that if their crypto system is designed around derivative keys that they control, but you can design a system that does not work that way.
Apple, for instance, encrypts a lot of your data using your AppleID password, which they obviously don't know, so they have no way to decrypt that data.
