Many large companies will not trust their data to an outside company under any circumstances. They will put the SaaS solution on their intranet only accessible locally or thru a VPN. If the SaaS company isn't willing to do this, then they won't sell to these companies. This can be a valid choice for the SaaS company as long as they can find enough other customers to make them profitable.
Or, the data is hosted externally, but you can only access it through your company's VPN.
VPN still comes up.. Things like test-environments, analytics databases, etc. It's easy enough to do in the cloud though.
For everything? Does no one save any files ever?
What about the support staff? Not too many people using a SaaS SSH instance, or SAAS RDP service.