In theory it shouldn't matter whether my security expertise is in-house or I pay some external party to provide it, right?

You are not paying an external party to come by and secure all your servers/applications — you are paying for a service which require you to share a lot of your data with a third party.

The usual argument for economies of scale also applies

But the bigger the third party you outsource to is, the more people will try to hack it.