Security costs money, reliability costs money. If it's not in your contract, you don't pay for it.

if there's any outage that is because the customer didn't ask you do do something that's their fault not yours.

For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it?

Would you patch all your systems immediately even if it caused availability issues if it wasn't explicitly outlined in the contract?

would you explain to your shareholders that your profits were lower this year because you undertook activities not specified in your contracts because they were good for the security and reliability of the services you managed...?

When outsourcing contracts are bid for there's a common experience of lower costs win. that inevitably leads to items that aren't strictly required being excluded.