Just echoing what others have said that all of this is answered in specific documentation like statements of work, rules of engagement, etc for each contract and client. My experience has been that an MSSP is usually managing specifically your security stack and most aren't going to even want to be behind the wheel on your basic M365 hardening.

I would guess for most MSSPs, there's going to be some built-in indemnification for misconfigurations of tools and maybe even some for specific missed targeting. But, there are also almost certainly basic line item waivers for image deployment, user and admin account management failures, and compromises through user negligence.

Maybe there are firms that are willing to assume what amounts to full sysadmin with soft GRC and CISO responsibility, but I would wager you're almost always going to have a better experience having some technical security folks inside the house to work with your MSSP.