This is absolutely a scale thing. Small teams and employers can learn about each other and evaluate risks more accurately than big corporations.

If I hire a security guard for my own company and perimeter I'm familiar with I know exactly how much work is needed to secure it and I know exactly what I should expect from my guard. On the other hand, if a big specialized company does this as a service they don't know this and thus impose stricter requirements and expectations.

I think this makes sense but also why can't we just do more of the former and less of the latter as it's clearly less efficient from societal pov even if appears to be more efficient from purely economical one.