Not entirely true. Everything is up for haggling, essentially. Otherwise you wouldn't have Spider-Man references, and Michael Keaton, in Morbius. Even if Sony owns the Vulture character, they don't own the MCU version of it, so you can be sure Disney would have had their lawyers shit all over...