What's the risk, and does that change by moving to an alternative?

Companies deal with leaked secrets a lot. A company already using a password manager is ahead of the game.

Suppose they move to a competitor. That's a migration and training that someone has to drive. What do they gain? Another company that can also have exploits? Or they self-host, and now have to fund that, and still potentially get exploits?

Ultimately, this likely isn't that big of a deal for a company.

And they have to weigh it up against all the other things that they can be doing.