Sure, many of us can do stuff like that, but the average user can't.

But the default expectations are very different. The default expectation for a web hosted application is that all your private stuff is stored in a database with dubious security, and if your data is stolen as a result the only consequences are a 'whoops, my bad' (at most!) from the company.