The vendor lock-in angle is the real story. Once you have AD, Exchange, Teams, and Azure all tangled together, the exit cost is enormous. I've watched orgs get approval for a full cloud migration based on cost savings projections that completely ignored the engineering cost of the decade-long migration that follows. The security issues are real but the procurement inertia is what keeps them renewing.