“States can’t dispense with their human rights obligations by delegating core services and functions to private companies on terms that they know will effectively undermine those rights for some people.”