Security might play into this, but the main factor would be giving internal documents to a third party that didn't have everyone sign a large stack of NDAs.

Not security, compliance.

German companies are generally very cautious, if not just scared of any type of external hosting. I'm not sure in what way is that connected to legislation, but the way the EDV-departments (Elektronischdatenverarbeitung - electronic data processing) work in companies here is mind boggling. It's like the progress was happening here not thanks to IT, but despite its overreaching presence.

A lot. Like nearly all Car manufacturer or Banks.

There are NDA issues, as well as data protection laws in the EU that mean that if you don't store data locally you need to got though a bunch of red tape (and get the person who is storing the data to also get audited). Oh, and good luck if the company is not in the EU (or even in another country).

Not to mention that we should really stop increasing our reliance on "the cloud". It's someone else's computer which you have no control over.

Financial services doesn't like cloud hosting. AWS is approved in most companies, but relying on another company (with access to your data) that builds on top of AWS means a lot of audit and certification for compliance. On prem is often just cheaper and faster to implement.

Check out https://www.replicated.com