Let me add another important point: outsourcing responsibility. In case of a data breach, you have someone to sue and you don't need a whole internal team to be up to date on the latest security topics. Instead, they just have to be able to manage the web interface (not saying that is easy, just less subject to changes)