OP,
I have heard of firms hijacking deliverables, but I have never worked for one. The firms I have worked for basically had the mindset that any work you've done in pursuit of completing a project for a client, is the clients, provided its of quality, does not require the submission of any propriety of work of the firm, or would reveal protected communication within the firm. Of course, we had a standard deliverable set based on the original PO but if a client wanted to see the calculations for something or was using like software and wanted the native format of a file such as Etap or AutoCAD. None of the firms I worked for had any issue with providing those. That said, I have been involved with projects with multiple engineering firms where the client would ask another firm for something like I mentioned, and the firm would want typically a substantial sum for the additional deliverables requested. Some clients would pay, others would tell them to go pound sand and blackball them from the facility. Maybe I'm naive and this is how business is typically run but I never found it ethical, considering I had already done the work for the client and in my mind it is theirs.
dpc has a good point in making them contractually agree to it but from a personal perspective, I would not want to do business again with a firm like that. They may be the low bidder but, is it because they are truly more efficient? Or do they just intend to nickel and dime you later with change orders and hold deliverables hostage?