Indeed! Cybersecurity is not a commodity among service providers. One is not necessarily like unto another. Some MSPs have robust and mature cybersecurity controls while others are lackluster. It is imperitive that the client ask questions to their MSP to better understand their capabilities. Because, as you said -- they inherit the security of their service providers.
Managed IT services heralded a proactive approach to IT, attempting to conduct maintenance, upgrades, system monitoring and issue resolution on a routine basis, with the goal of preventing problems before they started. Automation, increased Internet capabilities and cloud computing allowed for monitoring and issue resolution to be provided remotely, enabling more efficient processes and a consolidation of resources.