For months, years actually, I've looked very closely at the external attack surface of every Fortune 500 company and well beyond. I’ve learned that almost none, "moved to the cloud.” That’s a falacy. Instead the added stuff to the cloud and left the legacy where it always was.
The vast majority of companies where the bulk of their external attack surface is currently hosted in the cloud, that’s how they originally started building their IT infrastructure. They didn’t MOVE their either.