I am a social worker and SharePoint is unfortunately widely used by nonprofit agencies for storing client records. It's a real shame, but they can't afford anything better.
Some of it will be about reliability, i.e. the office burns down and Microsoft still hold a copy. Some of it will be about having a third-party that is "trusted" handle the most dangerous part - security. If SharePoint gets compromised there is plausible deniability that "we did everything we should do".
I know for example that some companies will hire subcontractors for high risk parts of a project, just so that there is somebody to blame if anything goes wrong.
