When they talk about security, they mean building security, hardware security and update security
not application & data security.
Ultimately though... you pay in the end, you can no longer enjoy those gig links to your own data servers,
What is better? having an internal email server that pulls emails 24 hours a day over a slow link to have user access at gig speeds OR have an email server in the cloud that has gig links 24 hours a day... only to be accessible to your WHOLE company 8 hours a day at 25M and have to deal with the likes of China who terminate your SSL links randomly....(keeping in mind that M$ is trying to fuck us all over by moving apps to the cloud)