I think you have every single one of these risks exactly backwards:

Potential for Data Breaches: - The idea that third parties have inherently higher breach risk is pure FUD.

Data Sovereignty and Compliance Risks/Limited Overside: - Having every single company solve all of these problems for every single part of their software stack is obviously very inefficient. That's why we have SOC II, Pen Testing, etc, as other commenters point out. The process of reviewing vendor SOC II reports is way, way easier than having to manage the cost of managing compliance for the hundreds of little productivity apps your team want to use!

Shared Responsibility Model: I think its pretty typical at this point for companies to take ownership over the behaviour of their sub-processors from a risk perspective.