Things aren't black or white, but SaaS typically removes one layer of security (the corporate firewall). Misconfigurations are then typically exposed to the whole world.