In a prior role, we realized something similar with outages. For our particular product, we AWS went down - we went down. We freaked out the first time, but after it was done we realized not a single customer had inquired. This felt unusual since we were getting emails quickly if we have a self-inflicted outage.

Turns out, when a major provider went down all of our users were too busy fighting their own fires. When they do notice, it's on a day when ALL of their vendors are struggling so we don't get singled out as a bad apple.

The whole "No one gets fired for using IBM" analogy.

This is especially true if the majority of your customers are also on Microsoft/AWS/etc.

Literally 0 of your customers will notice that you are down if their own systems are also not working.

This is perfectly valid for many businesses, up to a (shockingly high) level.

Yeah, if Exchange goes down, you get a day off. If the little boutique email provider you chose goes offline, you get a day in calls with everyone yelling at you.

If you need deniability, sure.

But it you actually NEED security, it's clearly not an option.

It's today's "nobody ever got fired for buying IBM". You're really just want the the SLA (someone to blame when things inevitably fail)

You are just describing how they're a more valuable target for an attack.