The IRS is not paying $11M for the development know-how to maintain security; it's true that they could probably shop around and find the services they need for much less.
No, they're paying $11M so they can say "We paid Microsoft $11M! What else could we possibly do?" when something goes wrong.