Some good points but for me this misses the insider security risk of these organisations which scale doesn't help with. This could be the company acting against you or it could be an individual acting without authorisation.

Suppose you are a startup that may be of interest to Google in an acquisition, why even give them the opportunity to read your mail by using Gmail?

I also have some concerns that the stacked layers (SaaS tool, on Heroku on AWS) leaves you exposed at all these layers to a bigger pool of insiders and potential creates different opportunities for outsiders to attack although it may well still be more robust to external attack than self hosting.