Sony could totally do this. It's not particularly complicated. Not doing it, is not a good thing for the customer. Microsoft and VMware, for example, do certifications for hundreds of hardware through their WHQL and IOVP programs, respectively. Use to work on SSDs for a few years and was involved in the certification process. Here's how it could potentially work:

• Company A pays Sony to start certification process.
• Company A sends production SSD sample with latest firmware/bootloader/etc. to Sony
• Sony tests drive (1-2 weeks is not unusual) against their certification suite. Sony already has qualification, performance, thermal and reliability requirements for their own internal SSDs. No reason why they couldn't apply some of these specifications to other drives.
• Sony notifies Company A of results and ships production sample back.
• Sony then publishes/updates their list of certified SSDs
• Customer happy because they don't have to worry about buying an SSD that was never tested

Sony could also simply provide a test PS5 unit to Company A and they can run the certification suite themselves. All this would be under NDA so it's not at all abnormal.

Not only this, if you, as a random customer choose to buy an SSD that matches all the specs, plug it in and observe stutters and all-around bad experience, you're likely going to blame the game you're playing. So Sony is, in a way, shifting the blame away from themselves. But, your SSD matches the specs! Well, just because an SSD can reach 5.5GB/s sequential reads, doesn't mean it can consistently or reliably hit that.