As an industry, we have abundance of choice. You're not practically nor theoretically locked to SaaS vendors - there are equally good self-hosted open source auth solutions.

A portion of our industry seems to be bad at risk calculation, but that's not inherent to the SaaS model - this app very well could've been made with strictly separated tenants.