a) You're ignoring the "and whatever else is next" part of my statement. If you're on-prem, you don't need to worry about hostile neighbors. Google Cloud engineers could be great at securing public cloud workloads, but even they don't know what's yet to be found.

b) You're not running untrusted, random stranger code on your Fortune 500 VM's. I can't signup for an account on Ford's VM's and start ripping through memory like I can with a public cloud.