I think we should expect SAML providers to be compromised. Given that, we need to design systems around that assumption. Google gets hacked, Azure gets hacked, Okta now. No one is impervious.

Now, that said, Okta should be more open in order to engender trust. I think this is where you are going with the comment and in this I agree.