I can't point you offhand to any articles, however here are some of my own ideas on the topic....
Substandard Internal security is probably cheaper.
There is a percieved security threat in outsourcing anything (especailly security)
People are probably comfortable/oblivious to the fact tat there internal security is substandard
Management tend to be (yes I know, I;m stereotyping) skeptical (sceptical?) about claims that someone else will do a better job than their own internal people (ironically, they often seem happy to tell their employees the opposite).
Yeah, a lot of decisions tend to be made around the mindset of a known evil to an unknown evil. You know what you are going to get with internal security, but what if you outsource to the wrong person?
I would also suggest culpability as an outline point - there is someone in the company that they can blame and fire if something goes wrong, whereas with an outsourced security company, there is no control over hiring, over best practice, etc... and while you can refuse to pay and go to another vendor, the person who chose to go to that vendor will most likely be fired... (a high-level firing as opposed to a lower level firing).