But it runs over your Intranet and so is generally as secure for outside access as your VPN is, which presumably gets more attention.
Also, Slack is a much bigger and juicier target for attack.
Ultimately it's a tradeoff. You may need to pay more attention to security in-house, but in exchange you're no longer tying the critical aspects of your business to some random SV web startup that is here today, but may get acquihired tomorrow and kill the product overnight.
the slack servers probably get a lot more security attention than your private XMPP or IRC server that probably sees a few minutes a year of attention from some engineer to run "apt-get dist-upgrade" or something.