Customers don't care that the breach happened at your vendor; they trusted you. Holding suppliers to your own standard — and verifying, not assuming — closes the gap attackers exploit between organizations.
“Outsourcing the work doesn't outsource the blame.”