"High profile company" and "smaller target" are somewhat mutually exclusive.

Think about it this way: Slack's entire business revolves around secure company communication. That's just a blip on High Profile Co's list of priorities.

Slack maintains a bug bounty program. What's the likelihood that High Profile Co is doing the same for their messaging app?

That doesnt change the fact that it's (a) high value target and (b) highly likely to be compromised by the people they worry about most. Whereas on premise means hackers run into who knows what apps, network configs, routers, OS's, etc. Lots of extra work for them. Plus some company and its employees dont have access go your data without a risky subversion.

Real damage hacks like corporate espionage you don't hear about, because it is in no one's interest involved to reveal those to anyone other than the buyer of the information, which usually a premium if it's kept discrete. No way to say this has not already happened.