On-premise CI/CD may still (and often does) use someone else's code, which can expose data and secrets in the same way as outlined. The only difference is that

On-premise CI/CD may still (and often does) use someone else's code, which can expose data and secrets in the same way as outlined. The only difference is that it's on your own infrastructure. There's something to be said for on-premise solutions, but they won't save you from a malicious maintainer.