You have to do some planning, but it isn't too hard. The most issues arise from compromises between security and convenience. Cloud services can offer both in the best case, but aside from O365, which is really sluggish, we are actually in the process of migrating back to on premise solutions.

Nobody attacks code repositories of non-software companies anyway, people are after CRM and ERP data. There is the occasional issue with malware from mails and special users, but a backup solution with 15min snapshots solves that issue. Although the latter can cost a bit and might be too expensive for smaller companies.