Why not?

Because I don't trust someone else to not train or steal our source code, or, even legally, introduce some silly cause after we are invested/locked into their infra, that allows them to do whatever with our property.

And on equal footing, I trust our security more than theirs. Case in point.