It's a lot easier to secure on-premise Exchange than Office 365. For one, having OWA exposed to the Internet is entirely optional for Exchange on-prem... but impossible for avoid for a cloud service. Most possible ways to secure access to Exchange on-prem are built into your firewall, and you can configure at leisure... most possible ways to secure access to Office 365 are billable add-ons to your subscription. Any side channels to that... you just have to trust Microsoft...

I agree there are trade-offs, but especially for large enterprises with security teams, on-prem is definitely more secure.