They don't need to request the person's SSN... they could just choose not to release the data that is tied to a non-dead citizen since they already have their SSN, probably.
Their page specifically says if its not a first party request (you requesting information about you), you must submit a copy of the Social Security Death Index showing the person is deceased. Instead of the requestor needing to provide that page, they could simply verify the SSN you're providing, in combination with the person's name, against the Social Security Death Index file internally.
"If you are requesting information on a deceased individual, you will need to upload proof of death unless the deceased individual is more than 100 years old. Acceptable proof of death includes obituaries, death certificates, recognized sources that can be documented, written media, Who’s Who in America, an FBI file that indicates a person is deceased, or a Social Security Death Index page."
> "If you are requesting information on a deceased individual, you will need to upload proof of death unless the deceased individual is more than 100 years old."
"If you are requesting information on a deceased individual, you will need to upload proof of death unless the deceased individual is more than 100 years old. Acceptable proof of death includes obituaries, death certificates, recognized sources that can be documented, written media, Who’s Who in America, an FBI file that indicates a person is deceased, or a Social Security Death Index page."
Emphasis mine.