Independent review of a medical device electronics engineering quote (IEC 60601-1 / 62304, PCBA + firmware)

We are a medical device manufacturer developing the next-generation electronic control box for an existing product. We have received a Statement of Work from an Indian engineering services firm covering PCBA design, firmware development and Engineering Verification Testing, and we want an independent expert opinion on it before we sign.

This is a review engagement only — no design work.

The device (in summary): mains-connected Class II active medical device. Single integrated 6-layer PCBA with a universal-input mains stage using a certified medical AC/DC module, four isolated AC relay channels, dual isolated 4-wire PT1000 sensing, coolant flow and CT current monitoring, an STM32H7-class MCU with external SDRAM, a 5–7" IPS capacitive touch display running LVGL, an LTE Cat-M1 module (hardware only in this phase), RFID, USB, RS-485 and a thermal printer interface. Firmware under IEC 62304 including a secure bootloader, control logic, alarms, data logging and the associated document set. The design must support certification for the US, EU and Indian markets from a single hardware SKU.

What we need from you:

A bottom-up sanity check of the effort estimate, work packet by work packet, with your own numbers where you disagree. We are especially interested in the firmware packet and the prototype/bring-up/EVT packet.
An assessment of the proposed architecture — is it the right approach for a 60601-1 device, and what would you have done differently?
Scope gaps: what is missing that we will end up paying for later, and what is quietly pushed onto us as the customer.
A short list of the specific questions and contract changes we should put to the vendor before signing.