The cloud isn't an adequate defense, it is just better than the defense less resourced companies and people can put together. With APTs it is all a competition of resources. If you can self-host and spend more resources than say Microsoft or Google on securing it, go for it. There is nothing more or less secure about doing cloud or self-hosting, what matters is how much money you can put into it but more importantly, how much talent you can attract. Not only do MS and Google have hefty bounties for finding vulns, skilled people flock to them for the opportunity to work there, even at lower salaries! Likewise, intel agencies and gov/mil units are coveted by skilled people.
To use a real world analogy, a chinese specialops unit might invade your small town and the argument here is to buy guns and practice shooting using the locals (self-host) vs calling in the army (NSA -- i blame them!) or paying a mercenary group (because the army won't dedicate a unit to your small town only). It doesn't matter if everyone in your town is ex-military, even if you defeat the chinese specialops unit, their mission will remain,they will just keep sending more people and more firepower and better strategies until they win. And just because a mercenary group lost to a chinese specialops unit does not mean you should have been using civilians to begin with, that's a false equivalency.