Exchange should be well protected behind a firewall or 10 after all these years.

What this leaves is a comparison of whether on-premise exchange servers have been compromised or down compared to the cloud.