Third-party accessibility risk comes from content an organization embeds but does not build itself: chat widgets, payment processors, embedded videos, ad networks, and third-party JavaScript libraries. Even a flawlessly accessible core site can fail an audit, or a legal claim, because of an inaccessible third-party component sitting on top of it.
Because an organization is generally still held responsible for the accessibility of what appears on its own site regardless of who built the underlying component, vetting third-party tools for accessibility before adoption, and monitoring them afterward, has become a standard part of a mature accessibility program.