There's a fairly wide history of self hosted Government Microsoft Exchange servers ending in ransomware payouts that suggests that blunt self hosting rules isn't as useful as it sounds.

And right now you look can look all the big MoveIT mass exfiltration hitting a wide range of orgs that wouldn't use Sharepoint "for security reasons".