Yeah BES is pretty cut and dry. Keep it patched and configure the policies correctly, then there isn't much to worry about. Granted you compromise a BES server and you have a nice MIM for the corporate email. Compared to the other mobile solutions out there, BES is still top notch for securely sending data to your mobile workforce. Not to mention you have the ability to centrally manage the phones without adding other 3rd party solutions. As much as I hate the blackberry phone itself, I can't argue about the security of the device. Going to a full Microsoft solution, you still need something to manage the applications and other non-Exchange related data. Though that all may be changing with Windows 8 mobile and Exchange 2010. MS has InTune which comes in local or cloud flavor (pick your debates for that one). Depending on the cost, it may make moving platforms to Windows mobile a considerable idea. I think BES currently runs almost 100 bucks a license for SMBs, 500 or more drops to 55 a license. For a Windows 8 solution, ActiveSync would be use to talk to Exchange. That should still have the ability to lock and remote-wipe a device. But managing the device configurations would require a subscription to InTune which is 6-11 per device per month. So the an org with 500 devices is looking at 65K a year to manage them. Exchange and ActiveSync are already bought and paid for. BES I believe is a one time cost with yearly support costs. So MS is looking a bit higher in the price tag.
Anyway sorry a bit off topic, but good things to way if an organization is thinking of moving away from BES in order to look at a BYOD type solution or switch to Microsoft only platform.