Say I've got a medical or heavy industrial client. They're not going to be very likely to push their production databases (or even snapshots frankly) into the cloud simply for this product (honestly they all have zero desire to push their data into the cloud as the majority of them have heavily invested in infrastructure over the last decades -- it's simply not an option at this time for them).
it looks like you want them to open their db up to the world?
What I was trying to say was that this is not the case. With Azure, it takes 10 seconds to open the firewall for a specific IP address. With a self-hosted firewall it probably takes longer but it's still not "opening their db to the world" as you stated. It's opening a hole in the firewall for a specific source IP address on a specific port with a specific destination IP address protected by a strong login and password. So, open for one person, closed to the rest of the world.
Your alternative is not to use the service.