The reason is arithmetic rather than skill. Covering nights, weekends and holidays takes several trained analysts, and security analysts are scarce and mobile. An MSP that staffs this internally is committing to a payroll that must be sustained whether or not clients buy the service, and to recruiting in a market that competes with better-funded buyers.
The common route is buying the function — a managed detection and response provider, or a SOC service delivered through your existing stack — and keeping ownership of the client relationship and the response decisions. That gives coverage without the payroll, and it scales with the clients who actually want it.
What to settle before signing is authority. "Monitored" spans everything from a notification email to an analyst isolating a machine at three in the morning without asking anyone. Both are legitimate services; they are not the same purchase, and your client needs to know which one they have. The second question is what happens next: a provider who finds something and hands you a ticket has moved the work rather than done it.