Except when they hire security contractors, and then that 3rd party assumes government powers - including police immunity - without the oversight. Which is what happens when cities ban technology uses such as facial recognition by the police - they just hire a 3rd party to do it with zero oversight. Same with large tourist events in non-tourist cities: those are not regular cops during the event, they are contractors with temporary police immunity and very little official oversight.