In most cases I'm much more concerned about companies being incompetent than malicious.

I trust them not to include a mail-stealing backdoor (which would likely be noticed quickly), but I don't trust them to secure my mail on their servers.