Stop! There is no reason why you have to assume the project risk just because you chose a more sensible metric to quote the price with.
Provide a top-line project cost number as an estimate, and then add an "additional time can be added to this project as needed at a rate of $XXX per day" clause.
The question of who assumes project risk is orthogonal to the question of how you choose to break out project cost.
I'd rather that part of my service is to give my client a sort of guarantee on the cost, given the requirements[1]. How many hours I work? What technologies I use? What OS do I work on? What's my text editor? What version control system do I use? These are things they shouldn't have to concern themselves with -- I'm a black box.
Do you ask Apple how much it cost them to make that iPhone? No!
[1] If the requirements change, then of course, my price will change (most likely increase).
Provide a top-line project cost number as an estimate, and then add an "additional time can be added to this project as needed at a rate of $XXX per day" clause.
The question of who assumes project risk is orthogonal to the question of how you choose to break out project cost.