There's always a precarious balance between security and convenience.
The customers own their code. They have been around longer for more oscillations between the "cloud" and bare metal than most people who have an opinion on it.
They're forward thinking enough to not embrace the cloud, or bare metal, and instead are exploring hybrid cloud technology that can run on a combination, and more importantly, move dev ops between different environments.
One reality is many people who blindly think it's ok to put everything on in the cloud, don't always know of the reality of liability, or have a relationship with any codebase and the associated IP for more than a few years.