Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.

Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes!

The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"!

Having to rearc after these terrible designs would cost more, so you can see where this is going...