In my experience—paying agencies to build and support Wordpress sites for over 15 years—I absolutely get billed for security related work, as well as bug fix work. And I should.
This seems more like a business model issue, or bad customers.
Look at it this way: if your customers had an in-house engineering team building and running their Wordpress sites, do you think they could get away with not paying those people for the time spent installing patches and mitigating side effects? So why should they be able to not pay their agency for that work?
That work is Part Of The Deal with running websites, in general, regardless of the framework or CMS. For sure your hosting providers are making sure their revenue covers those costs across their infrastructure. So why aren’t you?