The recruiter says they will need it to create my security ID as the role is through a vendor management system. Does this sound legit?
Never use an SSN or part of an SSN as ID. Never give out all or part of your SSN unless required by law.
This may be innocuous, but SSN number are not random, and even having the last 3 could expose you to risk. If you do not have to give your SSN to verify employment eligibility, then don't give anyone that information.
In general, using all or part of an SSN number as ID opens you to identity theft. This number is used company wide, and any unscrupulous employee could combine this with other information (like DOB) to steal your identity.
The best course of action is to simply explain you do not give all or part of your SSN to anyone due to identity theft concerns. I doubt the recruiter or company knows this is a security hole, but it is.
As far as I know, a recruiter should not need that data. Decline and/or change recruiters.
This is most likely a sub agency who is working through a preferred agency that is following an agreement set with the end client (who you will be working for).
I am guessing it is a larger company with a more robust IT security group. I understand know what the security risks for releasing this information is, and have no good reasons for why company's ask for it as opposed to other, less intrusive forms of verification.
Unfortunately this puts a lot of people in a tricky position. While it does sound legit as I have heard of this process employed by a large number of corporations, there are some security considerations.