I've seen that before as well.  The vendor I mentioned needed "SA" because they were creating user tables in the master database.  They even went so much as to fail their installation or update if the user was not in the system admin role.  I went around it by keeping that account disabled and had an alternate privileged account to use for any functions needed by SA.  To their credit, I've seen a more recent version of the application and they fixed that hole.