What's your responsibility of things go south and the wordpress gets hacked? Do you have liability insurance or any other protections in place?
Furthermore, unless a service provider has been acting negligently or has given some sort of guarantee like "With my services, your WordPress instance won't be hacked.", they usually can't be held responsible for actions and outcomes that are out of their control.
As you say, willful negligence, malicious acts, false advertising and fraud are of course not covered.