Technically the cage door is one level of defense and the rack door is the second level of defense, so by not locking the rack he is losing a layer of defense in depth.
If you have already had a policy about locked rack doors that may still apply to racks within cages depending on how your policy was written.
If your website advertises an auditing standard which should apply universally to the datacenter and that standard states something about the racks being locked in its physical security section, you may be able to point out that the client may be putting your compliance with that standard at risk (only if this is true). It's something to think about if you don't already have a policy which covers this.
It would also be wise for your team to check all racks (outside of cages), and cage doors for security every few hours. If this is a standard process you could start "reporting" this finding to them every few hours and possibly escalating the issue if appropriate.
Ultimately if you didn't have anything in place prior to this coming up you may be in a spot where you have to deal with this customer behaving this way as this may not be a contractual violation and you may have nothing to really leverage to get them to change behavior. Does your contract with the customer allow you to change security procedures and if so is it simply updating the policy and providing the client with sufficient notice that the policy has changed an option?
Keep in mind this may also be a hot button for your client, so be wise in how you approach this, and update your contracts and policies to prevent this issue or similar issues from being a problem with future customers.
Finally, I'd review your contracts and policies for basic things like smoking, liquids, foods, other organic materials, live animals/organisms, etc... You may find many other things missing that also need to be addressed. Bind agreement of these policies to your contracts if possible.
One additional thought: Ultimately you want good security to be easy to use. Is there a way to make it easier for your customer so he/she does the most secure thing automatically? Maybe this customer is having a problem with a poorly made key or something that could easily be fixed (depending on the doors maybe he/she thinks it helps keep the servers cool).
You want the customer to choose the most secure action on their own and not be forced to do so if possible. If there is resistance in their actions it might be wise to tackle what is creating the resistance rather than trying to tackle the customer.