Every so often a prospective client tells us their current developer pushes changes straight to the live site. It usually works. That is the trap: it works right up until a plugin update takes down checkout on a Friday afternoon, and there is no way to test the fix except on the same live site that is currently broken.
A staging environment is a copy of production where changes land first. Same code, same server configuration, and a recent copy of real data with sensitive fields scrubbed. Its job is to make deployments rehearsals instead of premieres.
The objection is cost, and it is a fair question. A staging environment for a typical business application adds a modest hosting line item and some initial setup. Against that, weigh one production outage: the emergency hours, the lost orders, and the customers who hit an error page and did not come back.
If your current vendor cannot tell you where changes are tested before your customers see them, that is worth a direct conversation. The answer should be specific, and it should not be your live site.