I can think of a few:

  1.) Shared resources, and exploits like meltdown and spectre 
  2.) Cloud provider employees potentially have access
  3.) Cloud providers are subject to law enforcement requests

However, there are benefits. Typically Google Cloud for example is going to have much better systems and security that a home-rolled data center setup. They've been working on it for years and essentially have unlimited resources (time and capital).