It matters because it solves the operating problem rather than the tooling one. Most smaller MSPs cannot staff round-the-clock monitoring, and detection that is only reviewed during business hours leaves the hours attackers prefer uncovered.
The thing to check before signing is what the provider is authorised to do. "Managed" spans a wide range: some services notify you and wait, others isolate a machine at three in the morning without asking. Both are defensible, but you need to know which one you bought, and so does your client.