I think this is not so much about where to get data, as to who makes the final call on ID assignment.
It's simple enough: if somebody asks for an ID and provides the information which is filed along with the ID, he will receive a new manufacturer ID. There is not much call for new IDs, and so far nobody has tried any funny business.
I guess there has not been any ID-collision yet?
(given that SKIstor 2000 (1989) has the autoconfig ID 32768 and netbsd sources hint that it's 16-bit unsigned, collision may not be that unlikely)
It's hard to say if there ever was a problem with ID collisions. From what I know, most of the Amiga hardware that ever was and needed a manufacturer ID was produced when Commodore was still in business. Fewer than 300 developers requested manufacturer IDs, and from the different fields they were working in, it would have been a real coincidence if any Amiga would contain even two different expansion boards by different developers sharing the same ID.
How many new devices is produced per year btw?
A year with more than one new manufacturer IDs to be assigned would be the rare exception. In the last 15 years only 11 new ID have been assigned.