[handrous]

Usually has to do with security requirements, often dictated by the industry they're in. Health care and military contracting are both huge, and are both areas that large companies tend to end up serving even if they didn't set out to do that, with the result that lots of enterprises need to be able to satisfy a variety of security check-lists, most of which are easier to deal with if a service is self-hosted. This can include things like "must guarantee no traffic containing X goes over an insecure network" or "must guarantee no data ever transits or is stored in [LIST OF COUNTRIES]". These directives can be in conflict for different orgs, too, so it's not something you can just fix one time in your hosted version and appeal to everyone.