AD is a security nightmare.

True, but so are all of the cloud platforms, so that doesn't really set it apart. Being legacy tech at this point without a lot of new code being added regularly, most of the weaknesses are pretty well understood.

EntraID requires internet but at least allows zero trust

Yeah I'm not convinced that Microsoft as an entity actually grasps the concept of zero trust. I think they likely have their own internal definition of it, just like they had their own definition of web standards back in the Internet Exploder days.

Look at what happened recently with Edge, where they claimed that storing user credentials in cleartext was "intended behavior":

https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-to-stop-loading-cleartext-passwords-in-memory-on-startup/

Rebuilding what it’s doing though wouldn’t take 30 years, they’ve figured out the requirements

Heh, I don't know about that... AD is the way that it is because nobody has actually figured out what the operational requirements of any given organization are. Certainly not Microsoft, not even after 2.5 decades of trying.

which means a startup can start fresh and build something even cleaner that works full on premise but seamlessly leverages cloud services

Do you work in marketing? did you get that phrase out of a brochure?

There's nothing seamless about anything cloud. Start taking apart any cloud platform and it will spill a bunch of ugly spaghetti and Swiss cheese.

There are no green fields, especially when you're talking about replacing an existing, operationally critical piece of technology. This is what you get:

https://xkcd.com/927/

in the event that your on premise systems have a failure.

If the on-prem systems have a failure there won't be any outbound network connectivity, there won't be anything capable of connecting externally.

The value prop is high for companies, if they could save a huge amount of money on licensing and get improved operational cost

That "if" is load-bearing. The "potential savings" are imaginary, theoretical at best. It doesn't really make sense to talk about "switching costs" when there's nothing to switch to. It's a big pile of "what-ifs" and "could-bes".

living in a cloud-first, Microsoft-free future

Oh really, whose cloud? Oracle?

We don't even maintain on-premises servers

Ah, you're dependent on someone else's computers, someone else's network architecture.

That sounds awful.

Nope nope nope, need on-prem only data, on-prem user account control, on-prem domain, absolute positive control of all outbound network connections with as few of those as possible, and no dependence on someone else's monthly compute fees.

Local always, remote only when absolutely unavoidable, and then stripped to the bare minimum. I'll run my own NTP server so that only it has to reach outside for time updates, and every other local device can get time from it.

NO. CLOUD.