To be fair this is pretty much how it has to work.

Imagine one rogue employee out of 10 commits fraud, do you get all your money back? No you get the billable hours + damages for the fraud.

If it worked the other way contracts would be longer than the actual work to be performed.