1) I am paying for the service. Many people do.
2) Encryption needs to be easy enough to use. With GDPR we cannot put any personal data (about third parties) on a cloud host without holding the encryption keys ourselves. That means, for anyone in a management role, nearly nothing. For ordinary users, no copies of email addresses of a group of people ... in fact nothing about anyone. Saferoom works, but the workflow is prohibitively cumbersome.
Sure I can carry on using Evernote for things which don't hit any of those pain points, but it now means I have to be thinking about "can