The problem is that if these tools are hosted by someone else, you cannot verify they do not also have your data. Once you grant them access to it, they can copy it, sell it and send it elsewhere, etc. Since, yes, we have decades of experience that companies do evil things with your data, we can easily recognize sharing your data with hosted applications is a recipe for abuse.

Meanwhile, there is almost no downside to requiring apps be runnable on a service/storage provider you trust. If I trust my storage provider, I can trust apps won't be permitted to do bad things on my platform. Whether that's a self-hosted service or a trustworthy SaaS, you are far better off demanding apps be put in containers you can host where you want rather than opening up your data to various destinations.