As an organisation we are considering whether it is safe for us to host non-open-data (e.g. Ordnance Survey data) on ArcGIS Online but set the sharing of it to Organisational only.
Do any UK users have any insight here?
Not a UK user, but sharing data layers at a non-public level (org-wide or specific groups) is going to be as safe as your users' passwords. If you're concerned about that, you could turn on MFA, or only share via groups on an as-needed basis, to keep the level of exposure minimal.