"Maintenance" is one of the vaguest words in this industry, which is exactly why it's easy to underdeliver on. A real plan is a specific checklist, not a vibe.
At minimum it should cover: dependency and plugin updates on a schedule, automated off-site backups you can actually restore from, uptime monitoring with alerts, and security patching. Anything less is just hoping nothing breaks.
The reason it matters: an unpatched plugin update taking down your checkout at 2am is not a hypothetical. It's the single most common emergency we get called about — usually by someone whose previous developer has long since disappeared.