Is there really much of a difference in this case? If your on prem software has a vulnerability and it is connected to the internet then it is just as vulnerable as the same software on a cloud provider. I would argue the cloud one is more likely to be set up more securely.

Cloud certainly has some different risks but I can’t definitively say it is short sighted and more risky compared to an on prem solution that a typical IT department would implement.