I explain to my clients that a website needs maintenance, just like a car. Things get old and either break or become "dangerous" (aka security flaws). I tell them that they should either find someone to maintain it or I'll do it for my hourly rate. If they don't hire someone to maintain it then I make it clear that it's not my fault if something is broken.

If it turns out something really is broken and it's 100% my fault and it's something that I shouldn't have done (leave the admin account as the default "admin"/"password" credentials) then I'll own up to it and suck up the losses to fix it, but so far I haven't done anything stupid like that.