In theory it shouldn't matter whether my security expertise is in-house or I pay some external party to provide it, right? You are not paying an external party

In theory it shouldn't matter whether my security expertise is in-house or I pay some external party to provide it, right? You are not paying an external party to come by and secure all your servers/applications — you are paying for a service which require you to share a lot of your data with a third party. The usual argument for economies of scale also applies But the bigger the third party you outsource to is, the more people will try to hack it.