Working as a continuity and emergency management contractor I can tell you no matter how good any professional is, devs included, if its not specified and outlined, its not getting done, that likely takes extra work/extra time and nobody rides for free. Plus, there may be a reason for why they didn't ask for it. It might be a stupid reason but its still not worth giving away your time and labor when it very well might just aggravate the client since it wasn't something they asked for. Maybe they're regulated and have to have things done a certain way (PCI, SOX, HIPAA, Title 13, EO 13526) or have security measures that you don't have need to know for that they'll add later.
None of this is to defend shitty practices, bad code, or bad QA, but when you're not told it needs to be done and you're getting paid a pittance even if you think its utterly stupid to not do whatever, it probably won't get done unless you run into the world's dumbest freelancer.
Academics publishing papers, who are universally seeking tenure (which is about the antithesis of temporary or freelance work), are probably the absolute fucking last people I'd ask about anything to do with a freelance job or the gig economy.