From the InfoSec perspective it's perfectly reasonable. No surgeon can (or should!) guarantee a 100% safe operation, no lawyer can guarantee conviction or acquittal.
Of course, the customer doesn't want the InfoSec professional to take their money and hide behind that clause in their contract either, if something were to slip past the audit.
I'd suggest that the solution to the issue is exactly what you mentioned - setting the right expectation. The customer should expect that the InfoSec team will do their very very best to detect common, easily exploited vulnerabilities. There are many ways to signal that you truly intend to do your best.
Financial guarantees specific to the scope of the audit request: e.g. 100% refund for a SQL injection exploited post-audit.
Reputational guarantees: e.g. "Secured by ACME InfoSec" text on their website, so that the InfoSec professional has a vested interest in keeping the site secure.
Multiple-audit guarantees: e.g. Offer to have a competing InfoSec firm provide a second opinion for comparison.
Testimony: From other customers whom you have helped in the past.
Proof of Work: Demonstrate actual effectiveness of your recommendations. e.g. Have independent pen-testers attack before and after your recommendations are implemented.
Of course, this all depends on a customer that understands that the only certainties in life are death and taxes.
For those that insist on 100% guarantees, you could certainly provide those within scope (point #1 above). You could (and should) include a maximum liability clause - e.g. the most that you will have to pay is $x.