Why are "Profile Types", "Risk" and "Controls" related list are present in the Vendor record and how are they related to those tables?
Please note that the 'Profiles' can be created for the records on the 'core_company' table. The "Profile's" 'Applies to' field points to the core_company record.
The Vendor records are nothing but the 'core_company' records.
'Profiles' can be grouped into "Profile Types" and they can be associated to a "Policy Statement" or a "Risk Statement" to create 'controls' or 'risks' respectively.
Since the 'core_company' (Vendor) is related to a Profile, which in turn is related to the 'Controls' and 'Risks', those related list are present in the Vendor record.