BOA also didn't (doesn't) really trust the public cloud. During several all hands meetings in the org, the inevitable question of "when are we gonna start using the public cloud" came up and the leaders would always say "we aren't because it isn't secure enough" or "we'd rather maintain our current governance model over what our devs build".

To your point, we need only point to recent events to show the universal customer pain that can be caused by a bad code push at Azure or AWS.