I’d guess because many IT departments figure that on-premise=secure and provides them the illusion that they can prevent source code from leaking this way.