> I think for many keeping source-code locked down is important.

This is the primary reason we went with self-hosted bamboo and octopus deploy for CI and deployment. It does move managing the infrastructure of it all over to our side, but it could always be worse, I suppose (previous jobs not having any sort of structured deployment workflow, in particular)