Could be as simple as the decision maker being able to point finger at the vendor. Could be PR related, where media does not report your company’s equipment was compromised. Could be reduced exposure to getting locked out of your own system and having to pay a ransom.