Maybe. These were vulnerabilities in every version of Exchange Server for 8 years since Exchange Server 2013 that were only detected because they were already b

Maybe. These were vulnerabilities in every version of Exchange Server for 8 years since Exchange Server 2013 that were only detected because they were already being actively exploited. Unless Microsoft has two distinct Exchange solutions, one for customers to self-host and one for themselves to host on behalf of their customers, there is no reason to believe, despite their claims to the contrary, that they were not similarly vulnerable until the exploit was discovered and patched internally. That would mean their system fared at most slightly better than an average self-hosted system which should not really inspire any confidence in their ability. Even if we assume that they did create two independent systems, there is no reason to assume that two products developed by the same company in tandem serving the same fundamental, lucrative use case should have material differences in quality/process. That there were multiple trivially exploitable, catastrophically effective vulnerabilities that were unknown for 8 years and that Microsoft never discovered themselves (they discovered it by realizing somebody else discovered it and was using it) should indicate that their cloud product is equally atrocious even if we assume that these were distinct products and thus would not be affected by the exact same bugs. In conclusion, as you say virtually every computing system out there is a house of cards, so there is no reason to assume that consolidating on the cloud and letting one of those groups of people focus will result in anything other than more houses of cards, except in this case being used on an even juicier target.