Is it possible for a third party to make changes to customisation/data if they don't have login access to NS?

If the changes are part of a bundle/suiteapp that you have installed. And they manage it, or if you choose to upgrade it.

It's a managed bundle that they installed and maintain. They do the upgrades, but I am not sure if they log in to our account to do that or have a way to do it remotely.

Updates of a managed bundle is controlled outside of your account. They do not log in.

Is it possible for them to remove customisation or data if they wanted to?

I think they can modify their bundle, and push update to remove the field that stores the data, not just the data