I don’t think there’s any need to be. Their target market is either business who need it on-premises for regulatory reasons, or its business who don’t. The former being hacked is the fault of the business, but that’s what they pay for with on-prem deployment, the latter isn’t critical (because it’s not regulated), the business has not committed a crime mishandling data or anything, and will seek compensation for damages from Slack.

Slack being hacked is generally just not something most business need in their threat model. Same goes for Gmail, GitHub, and most other business services.

That's hard for me to believe.

I can imagine people lackadaisically sharing things like ssh keys / passwords on it. I certainly have.

Any time something is hacked where the participants thought they had privacy is a potential disaster. Not sure how you can say otherwise.