Usually fear. They'll stick it behind terms such as "managing risk" or "data privacy concerns", but if you actually convince them to do their due diligence and deep dive into the vast majority of things inside Office 365 that are rated Tier C or D in the compliance framework you'll find out that you just spent a lot of time confirming exactly what Microsoft told you on day one. Will you find little bits and pieces here and there that maybe aren't ideal? Probably. In the long run do they really change the risk profile all that much. Not really.
So again, other than perhaps highly regulated industries or government requirements, it is fear of the unknown.
Delve in particular the concerns come from people getting access to see things they shouldn't, which is a user issue not a Delve/technical issue. Delve surfaces exactly what it is supposed to, so if it surfaces documents it shouldn't be to people who shouldn't be seeing it, that is because permissions are set incorrectly. This should be celebrated as now you can close that gap instead of sticking your head in the sand and continuing to play the "security by obscurity" charade. Not to mention that if permissions are set wrong, enterprise search would surface the same exact thing except no one is probably using enterprise search that deeply to find it.
Have I ranted enough yet? Is it obvious that I've dealt with issues like this in the past yet? ;)
