If I give someone in the US access to my code, systems, and, inevitably, customer data then I have a lot of legal recourse against that person if they do something bad. They have a lot of incentive to be careful and follow the rules. Their desire to maintain their reputation and avoid legal liability aligns our interests.
If I hire someone in the US and they hand everything over to a random person in a foreign country who doesn't care in the slightest about US laws, then they don't care about anything other than keeping those paychecks coming for a while. They don't care about anything, especially once those paychecks stop coming. It's even more complicated because the company isn't the one sending the paychecks, it's the person you hired. If that person has a falling out with their outsourced counterpart and the outsourced counterpart decides to take revenge on the company as leverage over their front-person, it gets bad.
> Security? It applies if you're working on defense software, but other than that...?
Are you suggesting that security only matters to defense software? You've never worked on a project that involves customer data? You've never worked on proprietary software that your competitors would love to have?
Do you not get annoyed when companies leak your personal data?