The company is making a big bet on professional contractors just as its core DIY customer is pulling back, creating a new kind of vulnerability.