More likely, this is a spectacular version of CYA. By billing the hours, there is a paper trail so that when the inevitable breach occurs, you can point to having done the appropriate thing.