If a vendor processes personal data for you, laws such as GDPR legally require a DPA to be in place. Beyond compliance, it protects your organization by defining exactly how the data must be secured and used, and what happens if there is a breach. Without one, you carry both legal and security risk with no contractual recourse.
