What liabilities? Cloud operators are breached on a monthly basis and there are no repercussions.

What makes you think F500 companies don't get breached all the time?

Exactly. I know if a large bank that went to the cloud after one of its infrastructure employees walked away with data on a USB stick.

Could be as simple as the decision maker being able to point finger at the vendor. Could be PR related, where media does not report your company’s equipment was compromised. Could be reduced exposure to getting locked out of your own system and having to pay a ransom.