And because it's not trivial for SaaS to support your self-hosted IDP.

We have standards like OIDC 2.0, but every IDP (including the big ones like Entra and Google) have subtle differences that still requires custom code per IDP. So all SaaS you interact with will have to do work to support your specific IDP solution.

Then there is support, you can't reasonably expect a SaaS that you pay a few bucks a month for to help you troubleshoot problems when authenticating using your self-hosted IDP solution inevitably fails.