Most clients will not agree to pay extra for a more secure web site though. Unfortunately. Unless they’ve been bitten in the past, which most businesses still haven’t.
As long as you put the alternatives clearly on the table, you could let the customers choose, and sign off on taking the risk. You can give a recommendation, but ultimately it's their choice if they bear the consequences resulting from the choice.