Cost of Inaction
Skipping an MSP seems cost-effective...until the cost of inaction hits.
It's more than just the cost of a breach.