For the flash version, you're safe targetting FP10, and you could even bump for 10.1: http://www.adobe.com/products/player_census/flashplayer/version_penetration.html
I'd specify AS3, as any design company still using AS2 for their flash needs as so far behind the curve that I wouldn't have confidence in their abilities.
Ignore browser compliance: it's flash, it just works.
Ignore OS compliance: it's flash, it just works (At the very least they should test it though).
Mobile: For the most part, if the phone supports flash, you should be fine. Where this is important though is optimisation (small file size for SWF and assets, good memory management, good speed, throttling the frame rate when it's not needed...). Depending on your site and what you do, take care with video etc. Basically, anything you see on Flash Site of the Day (http://www.thefwa.com/) is probably going to brick your phone, so it's really how important this is to you.
Web compliance: if you want your site to be indexable by Google etc, it takes extra work
Accessibility: if you want your site to be usable by special needs users (screen readers, keyboard-only navigation etc), it takes extra work.
Security flash cookies: not sure what you mean by this, but cookies are standard and probably done at a browser level rather than flash level (unless you're using shared objects for storing settings etc). In any case, it's not really a problem
Depending on how much flash is in the site (i.e. if it's a full flash site, or a html site with flash elements) these points become stronger or weaker - if you're including html in the bargain then you've different elements to look for. For the most part, the company should know all this stuff if they're any good.
Depending on how much content you have in your site, it may need an internal search (takes more work), or work with internal pages (i.e. it's possible to go to mysite.com/shop/item#blah and not be only able to go to mysite.com and have to manually navigate to the page every time)
A final point I'd put in is to make sure it's actually useful. Full flash sites that are just flashgasm intros and 20 minute long transitions betweens pages etc really suck. Hard. It might look cool but you'll hurt your business as for most people your site is useful if it's convenient.