Ask where their numbers come from. An honest estimate is accompanied by a list of assumptions, a breakdown by feature or module and a range rather than a single number.
Write down what done means feature by feature. Acceptance criteria do not need any formal notation: a plain-language note stating what must be true when the feature works is sufficient.
Say what the word done means for the important items. Clear acceptance criteria do not require any formal notation: a short list setting out what a user should be able to do will do.
The team you are quoted matters. A day rate says very little on its own: a senior engineer at a premium rate is often cheaper overall than two juniors who require heavy code review.
Handing a project to a vendor implies the vendor owns delivery: the partner staffs the team, the provider manages the process, and they carry the risk of missing the date.
Third-party integrations are the next major multiplier. A feature that touches only your own data is low risk; the same functionality connected to a payment provider and a CRM is another matter entirely.
Define what completion means feature by feature. Acceptance criteria do not require formal language: a short list setting out the expected behaviour is sufficient.
A few questions usually settle it. To begin with: is this software a core competitive asset, or a supporting tool? Next: for how long will the work last — a quarter or a decade? Third: who answers the phone at two in the morning when it breaks?