they've had issues with security around their own systems (payment info leaked, IIRC). And if their systems are compromised, because they have the ability to touch my systems (root password reset, for example), there's a potential breach there.

and they had their own massive DDOS attack which went on for days last winter (dec 2015?)