Vendor lock-in rarely announces itself. It arrives as a convenience: the agency registers the domain, holds the hosting, keeps the code, and manages the analytics account. Everything works until the relationship ends.
Ownership is a checklist. The domain is registered to the business. Hosting and analytics accounts are in the business's name with the provider as a collaborator. The source code lives in a repository the business can access. The content can be exported.
None of this makes a good provider easier to leave; it makes staying a choice rather than a constraint.