gosha If you sell them a care plan, you'll be responsible in keeping the site up to date and clean up the site if it got hacked.
If you're not selling them a care plan, it's their responsibility to maintain the website and also keep adequate backups.
If nobody intends to maintain the website, it may be a better idea to turn it static with something like WP2Static so it'll doesn't need to be constantly maintained and almost unhackable.