Getting the email server set up is easy, almost trivially so.
It's dealing with all the other issues that's an immense pain. SpamAssassin is not always a magic bullet, deliverability to third-party mail servers can be a major problem even if you follow all the rules, and Gmail's UI has a number of advantages that many mail programs can't compete with.
If you compare the hours of time a month that takes with the up-front elimination of hassle that Google Apps provides, it's not hard to see why a hacker might prefer to just outsource it and focus on tasks more pleasing to them.
Exactly, setting up a mail server is not hard. What's hard is that you have to keep your server secure; have to make backups, and make sure that backups work; have to troubleshoot problems when mails are not delivered, god knows how much time does it take; have to train your spam filter to get to the level as half efficient as Gmail is.
It's dealing with all the other issues that's an immense pain. SpamAssassin is not always a magic bullet, deliverability to third-party mail servers can be a major problem even if you follow all the rules, and Gmail's UI has a number of advantages that many mail programs can't compete with.
If you compare the hours of time a month that takes with the up-front elimination of hassle that Google Apps provides, it's not hard to see why a hacker might prefer to just outsource it and focus on tasks more pleasing to them.