How do you respond to "Vendor Security Questionnaire"?

These are typically very long forms asking everything under the sun. Two questions -

1. I understand going through this if it's an enterprise level contract. But for small self serve subscriptions (say $49/month), does it make sense to go through this process? If not, what is the alternative / how do you respond?

2. Are there legal ramifications of answering these questions? E.g. Say we tell them how we do encryption in transit and down the line we stop doing those for some reason. Then are we liable to inform all these companies and update this information? This would be an impossible task given how much info they ask.