Eh. I think you're underestimating how overmatched these IT depts are when it comes to cybersecurity.

Either sign a contract with a best-in-class (even if in name only) vendor who says that they'll do all of this for us or we need to become "experts" in cybersecurity and potentially still use them.

The CIO is overmatched here so they're making the decision that protects them and their clients in _almost all_ cases.