Even if the vendor never sees the attribution, I still think making one is the right thing to do. If it's a good piece of content, it might generate additional sales for that vendor; and if it's a dud, then it can be used as a warning to other customers.