I'm not a security specialist, but it seems to me that while managed services typically have better security and sysadmin resourcing, they also have the downside that their security can fail at a massive scale. If someone defeated the security of, say, GitHub, they could leak all the private repos stored there.
Managed services also have to accept connections from the public Internet, which on-premises solutions do not.
banks aren't safe because they're unrobbable, they get robbed all the time. They're safe because they're the ones taking on the risk. Data isn't fungible like cash though.
Managed services also have to accept connections from the public Internet, which on-premises solutions do not.