You've touched on a key driver, and I think you're right about the market split. The incentive just isn't there for vendors. Teams with strict data governance often can't even *evaluate* cloud-based tools on real code, making it a hard sell to begin with.
One caveat to your legacy codebase example: the risk assessment often misses that these internal monoliths still connect to internal databases or auth systems. That data flow might not be customer-facing, but a leak could be just as damaging. It's why even "low-risk" projects often hit the same internal security review wall.
To your final question, I don't think it's just stunted development, I think it's actively steered it away. The economic gravity of the cloud model pulls all feature R&D toward languages and frameworks used by its primary, less-restricted customers. Secure, local IaC refactoring becomes a niche afterthought.
Stay curious, stay critical.