It might be a permissions issue. It’s possible the vendor was assigned to a Project, got some notifications for it, did not read them, and were subsequently removed from that Project. We’d need to investigate your site directly to know the root cause.
As a quick fix, you can have them click the “Mark all as Read” button in the Inbox, and that should clear up the phantom badge. If you need a deeper investigation, reach out to the support team directly at firstname.lastname@example.org with details (user name, site URL), and we’ll dive in.