How do we know the maintenance we cannot see is actually happening?

Most of what you pay for is invisible by design, which is exactly why it needs to be evidenced rather than asserted.

Your reporting shows patch compliance by machine rather than a percentage that hides the three servers nobody touched, backup and restore test results with dates, security alerts raised and what was done about each one, and asset age against the replacement plan.

You can also ask at any time for a specific answer: when was this server last patched, when did this backup last restore successfully, who has administrative access to this system today. If a provider needs a week to answer those, they are reconstructing rather than reporting.

Use this in the sales process too. Ask a prospective provider to show you a sanitized version of what a client actually receives each month. What comes back tells you a great deal.