Not just the cloud. Any internet connected system, whether in the cloud or on-premises, is vulnerable to intrusion, data breaches, etc.
The only system that would be somewhat trustworthy would be a totally air-gapped internal system. This used to be the norm, pre-internet. Few businesses really have this today.
It was an RF tight triple wall secure engineering facility with no windows and power filtering. Vehicles and people searched on entry and exit. They knew very well of these risks a long time ago. To give you an idea, the building was designed in the 1950s where they even had dampers on the water pipes coming on site due to the use of typewriters historically.
The only system that would be somewhat trustworthy would be a totally air-gapped internal system. This used to be the norm, pre-internet. Few businesses really have this today.