Speaking as a huge enterprise, a SaaS SoR is useful BECAUSE all the components already work together, and I don't have to pay my own people to worry about maintenance or vulnerabilities.

Data egress and ingress are always possible, but then you have to manage authX (etc) in more than one place, more than two places, oops now it's 3, 4, 5 and now we got ransomware'd

Because as a huge enterprise you want stability and ability to check the boxes you need to check far more than anything else.

I'm at a medium enterprise and this is true. If I go with e.g. Atlassian I can get everything checked off, even if it's expensive and kinda dogshit. But I know they have a support system, I know they read CVEs and issue patch notes, I know I can find the info for audits and SOC2 cert and everything else.

Oh, some startup offers better software for a tenth the cost? Great. It'll be 30% more work for me to track down all that bullshit? Ok then, complete non-starter, I'll stick with Atlassian.

Because of Conway’s Law…

There’s so much process that gets put around the tools. Headcount that’s justified. Etc.