Worse, you might not even know that the government is watching or taking your data from SharePoint Online. While Microsoft claims that if possible they'll redirect government requests back to you for fulfillment, the feds may not let them, and then Microsoft may be forced to turn over a copy of your data without your knowledge. They may get a wiretap as well. And if the NSA has compromised the data flowing in and out of their datacenters with or without Microsoft's knowledge, then it's game over for the integrity of your data's security posture.
It's tough for many perhaps even most Fortune 500 companies to really get their heads around this idea. And while Microsoft touts the idea of a hybrid deployment, it's difficult and not inexpensive and (at least until SharePoint 2016 is released) a bit kludgy as well. On top of that, wholesale migration of all of your content to the cloud could take weeks and require investment in special tools, increased network connection bandwidth and all of that. All of these reasons validate SharePoint remaining on premises for most places that are already using it.
It's (sort of) an application development platform
Some companies have taken advantage of SharePoint's application programming interfaces, containers, workflow and other technologies to build in-house applications on top of the document and content management features. Making those systems work on top of Office 365 and SharePoint Online can be very difficult beast to tame. With the on-premises version of SharePoint, everyone has access to the underlying environment and could tweak and test it. Office 365 requires licenses and federated identities, and doesn't offer access to IIS and SharePoint application management features.
On top of that, a pure cloud or even a hybrid option still may not be any less expensive than using portions of resources and hardware your company already has...another reason why SharePoint is one of the last remaining applications that will make sense to run on premises for a long time to come.
It's a choice with less obvious benefits there is lower-hanging fruit
Email is still the slam dunk of cloud applications. Your organization derives no competitive advance, no killer differentiation in the marketplace from running a business email server like Microsoft Exchange. It is simply a cost center no one is building applications on top of email, no one is improving or innovating on email in a way that would mean it made sense to keep that workload in your own datacenter. Secure email solutions exist now that encrypt transmissions and message stores both at rest and in transit, so security in the email space is much more mature than, say, hosted SharePoint. No wonder Exchange Online is taking off.
Sign up for CIO Asia eNewsletters.