Its more about social engineering (this was the case for the m&s hack), if you outsource your work, you have less visibility over the people that work for you and it becomes more of a black box. This leads to worse employee awareness in general.