The issue with centralization is that you don't have to name one company where Slack is the weak point in the chain: a good exploit might get you access to data from 1000 companies. Then Slack could be a better target even if it's 999 times more secure than the weakest link at each individual company (assuming the attacker doesn't have a very specific, one-track target).