I don't think I've ever worked somewhere where you wouldn't get fired for sending company data to a party that doesn't have an NDA signed with the company, regardless of whatever ToS they have.

What is everyone using GitHub and AWS doing? They certainly all do not have NDAs with their code hosts and cloud providers

It's in their interest to do right by their customers data, otherwise there will be a heap of legal troubles and major reputation hit, both impact bottom line more than training on your data. They can and do in fact make more money by offering to train dedicated models for your company on your data.without bringing that back to their own models.

Everywhere I've worked has been strictly on-prem for source code (even when using Github), but I imagine company lawyers get involved with any kind of SaaS procurement? Like as an individual I'm not authorized to agree to any terms with anyone on behalf of my company. I know I've been in sales calls with suppliers where we had to wait for NDAs to be in place on both sides before we could talk.

I can relay that NDAs are very rare in typical saas procurement and that the ToS with data addendums are satisfactory for most people

Yeah, and who will make them accountable? How can you verify that they’re noteworthy stealing your data anyways? This companies don’t give a shit about copyright or privacy.

They say that, but how would you know if they lie?