It's pretty cool. I pay about 2.5 EUR a month for a nice cloud server. Indeed you can replace most cloud services with selfhosted, OSS options those days (for example there's nextcloud and seafile for file storage).
That is not a strict priority list. It is not unheard of to burn some money on celebrations and decorations, while cutting budgets in the essentials.
The appropriate question to ask is: at which size can you afford a competent security team in-house for what you would pay for a secure cloud offering. I would actually love to know the answer to that question.
"The Cloud" is just someone else's computer, or datacenter in this case. So if they would not be storing it in the cloud where would they store it? That would be either a datacenter from a big party that manages multiple municipalities as well as other government/for profit organisations IT. Most often this will be the lowest bidder for a public tender. I don't know if they would be any better or worse than the big cloud vendors. The only alternative is (shudder) a "datacenter" managed by the municipality itself. For big cities that might work. For smaller ones it's a recipe for disaster.
> They have special infrastructure and portals just for government customers.
The special infrastructure is for users subject to certain federal government data rules, which isn't coextensive with “government customers”. Most government use of cloud services from the big public cloud vendors is exactly the public commercial offering. Most government data is, both legally and practically, less protected than HIPAA PHI, which both government and non-government customers use commercial cloud offerings for.
The cloud provider is where it's at. AWS, Azure, GCloud ... and nothing from Europe.