IANAL, but based on my experience in Y2K where with the software I looked after there were a huge number of issues, there is little scope in practice for restitution of issues - the best outcome for the client is by resolving issues with the full cooperation of the provider. The only ones whom will be better off in such disputes are the lawyers.
What this means in this context is that your security concerns are best addressed in your selection of a provider - which should be reiterated in your contract. But the existence of requirements in the contract does not in any way reduce your obligation to ensure compliance with the contract before and during the development of the service - waiting until after the service to be deployed before you discover that the provider did not have the code auditing controls in place makes it your fault in my opinion, even though the provider would be in breach of the contract.
But with the best will in the world, vulnerabilities can still be introduced in code, by accident or by design - so it's certainly worth planning for this in terms of turnaround on resolution, defining scope of liability and ensuring that the provider will be able to make restitution in the event of culpability. Since the potential costs resulting from software vulnerability can massively exceed the cost of the software itself, there is no scope for (e.g.) using escrow.
Indeed, if you look at the article the points it makes about security (except for references to specific legislation) apply to all the functionality of the service.
At the risk of venturing off topic, IMHO the best solution is to manage the code auditing and testing (for all aspects of quality) independently of the provider even if your just replicating what they say they are already doing.
Going further, the security of the service also means the continued availability. Both this and the point raised in the previous paragraph show a clear requirement that you have access to the source code of the application. While financial escrow has a lot of benefits, IMHO, source code escrow does not, in practice, serve the interest of the client. NB that ownership of the intellectual property is not dependant on access to the source code - and specifically by providing the client access to the source code in no way erodes the clients responsibilities nor the providers IP rights.
However there are significant benefits to the client in owning copyright over the developed code, and where there is some assurance of the quality provides a useful bargaining position to trade off against future liability for the developer.