There is a major factor limiting the Google Apps acceptance: fear.
Small companies and individuals are able to comprehend the scope, security and privacy implications of Google Apps pretty easily - O horror! Big Brother is watching you! Duh, as if The Holy Triad (Equifax, Experian and Transunion) didn't already sell your intimate financial details to everyone and their uncle.
On the other hand, big corporations are neck deep in quagmires of existing policies - hardware and software procurement and user base, information access and security, legal retention and audit, cost to exit for existing obligations to name a few.
The most important issue in the context of Google Apps is information security and privacy. The very thought of trusting the crown jewels (or, at least, what they perceive them to be) to the outside entity causes a condition close to a heart attack for those that will be held responsible for the decision that's been made. Corporate officials don't like that. They prefer to keep the status quo and, ideally, not change anything at all. Or, at the very least, to deal with known threats.
Consequently, the hell with freeze over before corporations will trust^H^H^H^H^Hturn over their corporate data to Google.
How can Google get out of this predicament? I see two ways.
One, provide the user accessible API that will make sure that the only way to store the corporate data on an outside server is the encrypted way. This, however, introduces the whole issue of key and/or certificate management, which is somewhat familiar (albeit annoying) to IT folks, but which is going to kick the non-IT personnel out of their socks, no matter how simple it seems for the IT enabled. I don't see this happening anytime soon.
Two, allow corporations to physically lease the hardware that hosts Google Apps, like it does it for Google Mini. This will give them the warm and cozy feeling of being in a familiar environment, never mind that the people supervising the installation will probably orders of magnitude less experienced than Google would've dedicated to support tasks. It's BAU (Business As Usual) for them, which gives them an illusion that they can deal with it like they used to, which, in turn, makes them more likely to accept this sort of nuisance.
I've been expecting this to happen since the first time this topic was brought up in a water cooler conversation, about a year ago. Let's see how long it takes Google to deliver.