Speaking as a huge enterprise, a SaaS SoR is useful BECAUSE all the components already work together, and I don't have to pay my own people to worry about maintenance or vulnerabilities.

Data egress and ingress are always possible, but then you have to manage authX (etc) in more than one place, more than two places, oops now it's 3, 4, 5 and now we got ransomware'd