In my experience it’s very common for big companies to not host. Think Fortune 500 type companies. Most are legally happy with their MSA and reasonably confident in security standards.