DefiSafety has been active in the space for a good while, providing quite detailed reports since Aave v1 and never asking for payment from our understanding.
The question should not be if it is legitimate to support the project and get a certificate, it is if the DefiSafety team applied for a grant, and if so, was it given or not?
Obviously, we advocate for the DAO to be selective on this type of engagement/support, but with the track record of DefiSafety and requesting a budget of $15k per year, our opinion is that there should not be doubts on agreeing.