Because there's no way that your data, once uploaded to the app vendor's servers, can ever leak out. Right?

No way they are running their operation on the cheap and don't have their servers secured against intrusion.

No way they can be inexperienced developers and build an API that leaks information to improperly authenticated requests.

No way they can have a disgruntled employee throw a torrent of it all up when he gets fired.

No way they can get bought by someone with fewer scruples and hand your data over to them as part of the acquisition.