Workloads are starting to converge back to on-prem and there hasn't been so much pressure on only cloud. Hybrid approaches seem to be prevailing (for much larger co's)

Specifically, 83% of enterprise CIOs plan to repatriate at least some workloads back to private cloud/on-prem according to a Barclays CIO Survey program

On-prem is less likely to get patched and it's somewhat more work for the criminals to breach each installation individually but overall it's probably less secure.

Well it's single point of failure vs distributed resiliency.

You could hack your local dealership but if they can't sell, the customers just go to the dealership down the street, which serves as a very high incentive to get your systems back up and running.