We just did a pen test for a company who has everything local. We gained full admin access to their entire network and all their data.
Not surprising.
If it’s connected to the web, there is no such thing as security.
The way things are going, Amazon, Google, Apple, Microsoft are eventually, in all intents and purposes, going to be part of the government. If they have access to your data, the government is going to have defacto access to your data.