With controller, holding interact to open the vendor instantly buys the first item on the list.

When using a controller, holding A to open a vendor will instantly buy the first item on the list.

A more reasonable expectation would be that the hold-to-buy action only starts *after* the vendor UI has been opened. You would have to release the interact button and start your hold again over the appropriate item.

I suspect the bug is that either the game counts button holds before the vendor opens and immediately attempts action OR perhaps the hold-to-buy preventative measure is called too late and the buy action goes through before the hold preventative is active.