You can beg for one from a chip vendor, but they aren't really permitted to dole them out, and they will help once, but not for production distributions.
You can ignore it, make one up, or just try to take someone else's, but there be dragons that way too.
If you plan to distribute an actual electronic product under a real business name, you must first pay these trolls thousands of dollars.
It's probably a rounding error for companies who make billions of things, but for small market goods?
USB-IF says, "Get rekt nerd! Gimme yer lunch money!
I think most cheap devices I've tangled with use the vendor number of whoever made the chipset. (or a random one, because chineseium)