I think the parent poster's point is, concentrating all of these user accounts into one location makes it a more enticing target. Robbing a bank is more enticing than robbing a liquor store. To strech the analogy a bit, and support your point, Banks are better at securing the money.
So, to be explicit, in house maybe not as secure as slack, but the possible rewards are just your company's value. If 1000 companies are all in the slack pool, slack ought to be 1000 times better than a single company alone. Because the reward for a hack is so outsized.
Think about it this way: Slack's entire business revolves around secure company communication. That's just a blip on High Profile Co's list of priorities.
Slack maintains a bug bounty program. What's the likelihood that High Profile Co is doing the same for their messaging app?
There are a number of high profile companies that have gotten hacked as well, some of which had REAL damage done as a result.
Running On-Prem is no safeguard for hacks, and you are trading one set of vulnerabilities for another set.
Following that same line of reasoning, services like AWS shouldn't be used either, as they also provide a new threat vector for attacks.
////
This is from Mattermost's web site:
> Mattermost is written in Golang and React and runs as a single Linux binary with either MySQL or Postgres.
For an on prem solution, you've now taken on the responsibility for maintaining at least a few linux machines. Including patching, hardware failure etc. Next comes the database, including performance tuning, security configuration and patching. Finally when updates to Mattermost software itself, ensuring you stay up to date with that.
If Messaging is somewhat critical, you'll need to ensure you have fail-over/fault tolerance in your architecture.
You'll also want to make sure when you patch, you do a rolling patch, so you don't accidently break messaging.
Plus you'll want to backup your message data and run through DR protocols.
This will be in addition to maintaining all the other corporate IT internal systems a company may use.