An large amount of very sensitive information from a huge number of people is stored "in the cloud" making it a big target for hackers[1].
In addition, the attack surface of a company providing tax services on the internet is huge compared to a powered down VM on a machine that I know is physically secure and (IMHO) well secured against hackers.
[1] In a famous apocryphal story, Willie Sutton was asked by reporter Mitch Ohnstad why he robbed banks. According to Ohnstad, he replied, "Because that's where the money is."
https://en.wikipedia.org/wiki/Willie_Sutton#Sutton.27s_law