use cases that require _everything_ "on-premise" are often government/military, big healthcare, or just huge enterprises that want to control everything (and can afford a team that only runs their auth service).

I mentioned Ory above but you get both options - either as a managed service or run on your own infra