How much longer does it take N self-hosted instances to be patched compared to a single multi-tenant instance? How much effort is duplicated analyzing and securing self-hosted installations?
I don't know, but the post-it note in my left desktop drawer hasn't been hacked remotely yet.
Of course it is very vulnerable to evil maids' attacks.
Does a sticky help when there are vulns like heartbleed?
Point being, most hacks are not related to credential compromises.