The question is also whether those cloud providers are much better proportionally. They may put somewhat more effort into security but they're also a much bigge

The question is also whether those cloud providers are much better proportionally. They may put somewhat more effort into security but they're also a much bigger target. Then there also is the question of cascading effects. E.g. if someone compromises a cloud provider and gains SSO access to Org A and Org B at the same time they might be able to do more harm