So is any other piece of software you use. Do you expect software to be secure by default? Exchange comes with all apps and protocols enabled by default. If you’re selective on the services you need, place the server behind a smart host for spam protection, inspect the traffic on the firewall, I’d argue that it is as secure if not more secure than the cloud version. You have more tools at your disposal than Microsoft, which has to enable more services in more geographies. Just because it’s in the cloud, doesn’t make it more secure. I’m tired of people pushing the cloud for no reason other than lacking understanding. You’re renting the platform and the software, the same software you could run in your data center. Those staff savings promised by the cloud never materialized. And Exchange Online is a few orders of magnitude more expensive than the on-prem solution.