Scope creep rarely starts with bad clients.

It starts with not saying: that's out of scope, here's what changes if you want it added.